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Abstract 

The  purpose  of  this  research  is  to  develop  a  standardized  Information  Asset 
Valuation  (IAV)  methodology.  The  IAV  methodology  proposes  that  accurate  valuation 
for  an  Information  Asset  (InfoA)  is  the  convergence  of  information  tangible,  intangible, 
and  flow  attributes  to  form  a  functional  entity  that  enhances  mission  capability.  The  IAV 
model  attempts  to  quantify  an  InfoA  to  a  single  value  through  the  summation  of  weighted 
criteria.  Standardizing  the  InfoA  value  criteria  will  enable  decision  makers  to  compare- 
atively  analyze  dissimilar  InfoAs  across  the  tactical,  operational,  and  strategic  domains. 
This  research  develops  the  IAV  methodology  through  a  review  of  existing  military  and 
non-military  valuation  methodologies.  IAV  provides  the  Air  Force  (AF)  and  Department 
of  Defense  (DoD)  with  a  standardized  methodology  that  may  be  utilized  enterprise  wide 
when  conducting  risk  and  damage  assessment  and  risk  management.  The  IAV 
methodology  is  one  of  the  key  functions  necessary  for  the  Cyber  Incident  Mission  Impact 
Assessment  (CIMIA)  program  to  operationalize  a  scalable,  semi-automated  Decision 
Support  System  (DSS)  tool.  The  CIMIA  DSS  intends  to  provide  decision  makers  with 
near  real-time  cyber  awareness  prior  to,  during,  and  post  cyber  incident  situations  through 
documentation  of  relationships,  interdependencies,  and  criticalities  among  information 
assets,  the  communications  infrastructure,  and  the  operations  mission  impact. 
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AN  ANALYSIS  OF  INFORMATION  ASSET  VALUTION  (IAV) 
QUANTIFICATION  METHODOLOGY  FOR  APPLICATION  WITH 
CYBER  INFORMATION  MISSION  IMPACT  ASSESSMENT  (CIMIA) 


I.  Introduction 

If  you  know  the  enemy  and  know  yourself  you  need  not  fear  the  result  of  a 
hundred  battles.  If  you  know  yourself  but  not  the  enemy,  for  every  victory 
gained  you  will  also  suffer  a  defeat.  If  you  know  neither  the  enemy  nor 
yourself  you  will  succumb  in  every  battle,  ”  as  interpreted  by  David  E. 
Hawkins  and  Shan  Rajagopal  (Hawkins  and  Rajagopal  2005:134). 

-  Sun  Tzu 


Background 

In  a  very  real  human  way,  we  deal  with  valuation  daily.  In  the  morning  a  person 
makes  a  decision  on  whether  to  have  coffee  or  cola.  Internally,  the  person  places  a  value 
on  each  of  the  drinks  and  then  compares  the  values  before  making  a  decision.  The 
valuation  process  may  include  tangible  items  such  as  cost  or  caloric  content.  The 
valuation  process  may  also  include  intangible  items  such  as  a  personal  desire  for  one 
drink  over  the  other.  In  the  end,  a  small  valuation  process  takes  place  to  value  which 
drink  to  choose  before  heading  off  for  work.  Value  is  currently  playing  a  role  in  the 
information  asset  (InfoA)  prioritization,  however  the  details,  characteristics,  and 
arrangement  of  this  role  is  uncertain  due  to  the  lack  of  research  into  this  topic  area.  As 
Sun  Tzu  wisely  suggests,  information  asset  valuation  may  become  a  vital  component  of 
the  Air  Force  (AF)  ability  at  proactively  understanding  yourself  as  a  service,  before, 
during,  and  after  battle. 
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Understanding  value  is  not  as  easy  as  a  math  equation  and  requires  broader 
acceptance  of  intrinsic-based  qualities  such  as  intangibility.  In  the  accounting  discipline, 
intangible  assets  are  “non-physical  such  as  franchises,  trademarks,  patents,  copyrights, 
goodwill,  equities,  mineral  rights,  securities  and  contracts  (as  distinguished  from  physical 
assets)  that  grant  rights  and  privileges,  and  have  value  for  the  owner, ”(IGBV  2007),  and 
“assets  (not  including  financial  assets)  that  lack  physical  substance,”  (FASB141 
2001:105).  Ultimately,  intangible  assets  are  difficult  to  accurately  value  due  to  the 
subjective  nature  of  the  assessor. 

Importance  of  Information  and  System  of  Systems 

There  is  little  doubt  about  the  utility  of  information  and  the  system  of  systems 
connecting  the  military  and  society  as  a  whole.  From  a  historical  military  standpoint,  war 
is  possibly  the  most  powerful  demonstration  of  the  system,  and  information  importance, 
as  they  are  considered  priceless  between  battling  nations  from  the  Roman  courier  scalp 
tattoo  to  the  World  War  II  French  Resistance  radio  broadcast  (Miller  2005:58). 
Information  is  separate  from  the  systems  that  collect,  manipulate,  distribute,  and 
aggregate  that  information,  with  information  being  a  valuable  asset;  moreover,  the  very 
age  we  live  in,  the  information  age ,  underscores  the  value  of  information  (Nichols,  Ryan 
et  al.  2000:544). 

Current  Information  Asset  Valuation  Methods 

The  current  activity  of  information  asset  valuation  used  in  the  military  is  founded 
in  the  valuation  of  tangible  computer  system  infrastructure  as  a  whole  entity,  and 
information  components,  such  as  routers,  servers,  radios  and  other  such  physical  devices 
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(Wong-Jiru  2006:26)  that  are  used  to  manipulate,  store,  and  transfer  information.  The 
valuation  for  these  tangible  items  is  through  procurement  or  replacement  cost.  In  terms 
of  degradation,  or  failure,  the  valuation  process  includes  costs  for  recovery,  lost 
productivity,  or  lost  revenue  (Horony  1999:39).  This  method  is  predominant  because 
people  may  more  easily  understand  and  work  within  this  method;  moreover,  people  may 
easily  access  source  documents  to  define  these  costs  such  as  purchase  orders  or  personnel 
pay  checks. 

Importance  of  Information  Asset  Valuation  (IAV) 

This  research  intends  to  illustrate  the  benefit  of  the  information  asset  valuation 
(IAV)  methodology  by  providing  foundational  research  toward  potential  and  viable 
solutions  to  the  problems  of  a  lack  of  effective  bonding  between  infrastructure  to  mission, 
lack  of  effective  bonding  between  the  competing  functions  of  communications  and 
operations,  and  the  lack  of  immediate  and  effective  cyber  battlespace  awareness  for 
decision  makers.  Decision  makers  would  benefit  from  having  a  single,  recognizable, 
reference  value  for  each  information  asset.  The  single  recognizable  reference  value  for 
each  information  asset  should  enable  decision  makers  to  quickly  and  easily  understand 
the  importance  of  the  information  asset’s  relationship  to  the  mission. 

Current  State  of  Communications  and  Operations 

In  the  Air  Force,  the  two  functionalized  organizations  of  Communications  and 
Operations  are  responsible  for  valuation  of  information  assets  in  the  cyber  environment 
when  incidents  occur.  The  basis  for  an  information  asset  valuation,  both  current  and 
future,  is  knowledge  of  the  mission  and  knowledge  of  the  information  infrastructure 
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supporting  the  mission.  Figure  1  illustrates  the  frequent  problem  with  the  functional 
separation  of  the  Communications  and  the  Operations  communities:  statement  from 
Communicator  to  Operator  “Circuit  7JA  is  down”;  Operator  replies  “What  does  that 
mean  to  me?”  and,  “What  is  the  impact?”  The  Communications  area  of  concern  is 
maintaining  the  devices  to  successfully  pass  bits  and  bytes.  This  action  does  not  include 
management  of  the  content,  such  as  information,  passing  through  the  devices,  therefore 
Communications  cannot  adequately  respond  to  Operations  on  the  issue  of  mission 
impact.  In  Figure  1,  the  resulting  problem  is  illustrated,  but  from  the  opposite 
perspective:  statement  from  Operator  to  Communicator  “Our  ATO  terminal  is  down”; 
Communicator  replies  “All  circuits  and  systems  are  in  good  working  order.”  This 
example  demonstrates  a  typical  disconnect  between  the  Communication  community’s 
emphasis  on  cyber  activity  and  the  Operation  community’s  emphasis  on  mission 
capability.  The  potential  answer  to  this  problem  can  be  met  with  one  of  two  approaches: 
1)  developing  personnel  with  experiences  in  both  Communications  and  Operations  to 
build  a  bridge  of  common  understanding  for  mission  impact,  or  2)  embedding  the 
experience  and  knowledge  into  a  Decision  Support  Software  (DSS)  tool  that  presents  to 
personnel  the  common  understanding  for  mission  impact.  Each  day  Communications  and 
Operations  personnel  filling  these  positions  gain  experience  to  bridge  this  problem  gap. 
However,  a  well  known  issue  in  the  Air  Force  is  that  personnel  move  from  assignment  to 
assignment  undermining  the  aspect  of  mission  continuity.  The  gains  achieved  by 
personnel  in  knowledge  and  experience  move  with  personnel,  and  this  initiates  a  new 
training  cycle  for  the  new  personnel.  Embedding  knowledge  and  experience  into  the 
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software  of  a  DSS  tool  will  enable  new  personnel  to  quickly  increase  on-the-job 
experience  and  knowledge  for  accuracy  of  the  decision-making  process. 


•  Operations 

-  Mission 


Figure  1.  Communications  and  Operations  Disconnect 


The  IAV  methodology  is  important  in  order  to  provide  cyber  situational 
awareness  for  military  commanders  in  achieving  timely  and  effective  decision  making. 
The  ultimate  goal  of  this  research  is  to  develop  foundational  methodologies  for  the 
creation  of  a  semi-automated  Cyber  Incident  Mission  Impact  Assessment  (CIMIA)  DSS 
tool.  CIMIA  intends  to  provide  a  single  integrated  presentation  of  near  real-time  cyber 
environmental  awareness  to  the  competing  functions  of  mission  capability  (operations) 
and  the  supporting  computer  infrastructure  (communications)  prior  to,  during,  and  post 
cyber  incident.  In  essence,  CIMIA  will  facilitate  a  bridge  of  mission  capability  to  the 
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infrastructure  for  on-demand  damage  and  mission  impact  assessment.  Readily  available 
information  asset  identification,  mission  mapping,  and  valuation  will  enable  decision 
makers  to  quickly  and  accurately  understand  the  impact  of  a  cyber  incident  without 
expending  extraordinary  time  and  effort  to  gather  the  information  manually. 

Cyber  Incident  Mission  Impact  Assessment  (CIMIA)  Project 

CIMIA  intends  to  connect  the  segmented  information  systems,  which  currently 
respond  in  a  reactive  manual  method,  with  near  real-time  visual  technologies.  Previous 
research  was  conducted  by  Fortson,  who  identified  five  sequential,  and  potentially 
simultaneous,  components  phases  for  creating  a  CIMIA  tool,  as  illustrated  in  Figure  2:  1) 
Information  Asset  Identification  (IAI)  is  the  realization  that  an  information  asset  exists 
and  needs  to  be  documented;  2)  Information  Asset-to-Mission  Mapping  (IAMM)  is  the 
process  of  documenting  the  internal  and  external  connections  of  the  information  asset;  3) 
Information  Asset  Valuation  (IAV)  is  the  process  of  establishing  a  standardized  and 
comparable  information  asset  criticality  value;  4)  Damage  Assessment  (DA)  is  the 
presentation  of  cyber  battlespace  awareness  with  near  real-time  information  asset  status 
for  decision  makers  to  act  upon,  and  5)  Damage-to-Mission  Assessment/Impact 
Reporting  (DMAIR)  is  the  information  asset  historical  archive  for  trend  analysis  and 
what-if  scenario  forecasting  (Fortson  2007).  Shaw  contributed  significant  foundational 
research  toward  the  IAI  and  IAMM  methodologies  in  relation  to  specific  Air  Operation 
Center  (AOC)  processes  (Shaw  2007).  The  IAV  methodology  has  the  potential  to  play  a 
significant  role  in  providing  military  organizations  with  cyber  battlespace  awareness 
through  establishment  of  a  standard  for  valuing  information  assets.  IAV,  and  value  itself, 
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is  a  human  behavior-driven  exercise  that  requires  subjective  qualitative  measurement  to 
quantify  the  human  behavior.  Providing  a  defensible  methodology  is  the  solution  that 
will  allow  users  of  the  IAV  methodology  to  have  faith  in  the  results;  moreover,  an  IAV 
methodology  may  be  the  key  component  binding  the  other  CIMIA  functions  to  together. 


Simultaneous 
Or  Sequential 


Information  Asset 
Identification  (IAI) 


Information  Asset- 
to-Mission 
Mapping  (IAMM) 


Information  Asset 
Valuation  (IAV) 


Near  Real-time 
Cyber 
Awareness 


Damage 

Assessment  (DA) 


Actionable 
By 

Decision  Makers 


Historic  Archive 
For 

Trend  Analysis 


Damage-to- 
Mission 
Assessment 
&  Impact 
Reporting 
(DMAIR) 


What-if 

Scenario 

Forecasting 


DMAIR  Feedbackto  IAI,  IAMM,  IAV  &  DA 


Figure  2.  CIMIA  Five  Component  Phases 


Value  is  important  to  providing  decision  makers  with  cyber  environment 
awareness.  Just  the  level  of  assisting  to  describe  the  cyber  environment  in  terms  of  value 
should  organize  the  chaos  of  information  overload  to  a  useable  and  actionable 
information  state.  At  precisely  the  moment  when  an  incident  occurs  is  when  personnel 
time  is  at  its  most  critically  precious.  It  is  at  this  moment  when  personnel  need  to 
concentrate  on  solutions  for  maintaining  the  network  integrity,  availability, 
confidentiality,  or  mission  capability  instead  of  reactively  using  this  time  to  gather 
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information  on  the  system  of  systems  infrastructure  that  could  have  been  analyzed  long 

before  the  incident  occurred.  When  the  adversary  is  attempting  simple  surveillance,  or 

full-scale  attack  of  the  infrastructure,  is  precisely  when  personnel  resources  are  more 

useful  at  analyzing  the  situation  with  positive  cyber  awareness  for  accurate  and  effective 

decision  making.  The  following  passage  further  highlights  the  desperate  need  for 

information  and  system  of  system  awareness: 

The  morning  of  9/1 1  showed,  the  hijacking  of  airplanes,  the  time  it  took 
authorities  to  understand  that  a  serious  problem  existed,  and  the  absence 
of  procedures  for  handling  this  situation  generated  a  particularly  strong 
sense  of  surprise.  During  several  minutes  the  U.S.  Military  and  civilian 
air  authorities  found  themselves  in  a  state  of  uncertainty  and,  at  best  in  an 
inadequate  defensive  posture.  Just  a  momentary  loss  of  air  superiority 
proved  enough  to  cause  terrible  losses,  (Larribau  2007:28). 

Little  discussion  is  necessary  to  further  highlight  the  importance  of  information  and  the 

system  of  systems  in  context  of  cyber  environmental  awareness  as  these  now  pervade 

everyday  society;  moreover,  the  awareness  has  been  instilled  that  the  cyber  domain 

posses  at  least  as  many  threats  as  the  cyber  domain  provides  solutions. 


Problem  Statement  and  Investigative  Questions 

This  research  endeavors  to  answer  the  research  and  investigative  questions  that 
are  critical  to  the  creation  of  a  useable  and  trustworthy  IAV  methodology: 

R.  What  is  the  process  for  attributing  value  to  an  information  asset? 

1.  What  is  an  information  asset  (InfoA)? 

2.  Can  qualitative  factors  establish  value? 

3.  Can  a  single  value  be  established  for  an  information  asset? 

4.  Can  one  information  asset  have  different  values ? 

5.  Are  academic  discipline  models  adaptable  to  information  asset  valuation  ? 
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Thesis  Construction 


The  research  into  the  IAV  methodology  relies  heavily  on  quantification  of  human 
behavior  and  development  of  a  new  research  topic  area.  These  two  situations  compel  the 
research  to  deviate  from  commonly  accepted  research  methodologies.  The  most 
appropriate  methodology  is  an  exploratory  methodological  strategy  and  approach  hybrid 
by  taking  the  most  beneficial  portions  from  other  methodologies  with  a  qualitative 
approach.  This  research  has  been  conducted  in  the  multi-phase  of  a  qualitative  case  study 
approach  examining  public  sector,  including  accounting  and  law,  and  military  sector 
discipline  methodologies  for  adaptation  to  the  IAV  methodology. 

The  accounting  discipline  is  well  known  for  valuing  tangible  business  assets,  such 
buildings,  but  this  discipline  also  provides  valuation  for  intangible  assets,  such  as 
trademarks,  Fair  Market  Value  (FMV),  brand  and  trademark,  receivables  for  bad  debt  and 
subjective  analysis  will  be  examined  from  the  accounting  discipline. 

Intangible  asset  valuation  is  also  a  concern  in  the  legal  discipline  in  the  two  main 
areas  of  intellectual  property  infringement  and  natural  resource  damage.  The  area  of  law 
lending  itself  to  intangible  asset  valuation  may  be  found  in  the  documents  covering 
litigation  damage  assessment  such  as  the  United  States  Codes  (USC)  and  Comprehensive 
Environmental  Response  Compensation  and  Liability  Act  of  1980  (CERCLA). 

Military  processes  concern  themselves  with  the  quantification  of  intangibles 
through  the  use  of  defensible  qualitative  methodologies.  Some  of  the  processes 
examined  in  this  research  include  the  Classified  National  Security  Information  (CNSI), 
Operational  Security  (OPSEC),  and  Operational  Risk  Management  (ORM). 
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Foundational  Terminology 

For  the  purposes  of  this  research,  it  is  important  to  establish  a  common 
understanding  of  the  terms  Information  Asset  Valuation  methodology  and  information 
asset.  Information  Asset  Valuation,  referred  to  as  IAV,  signifies  the  methodology  or 
model  under  construction  in  this  research.  Information  asset,  referred  to  InfoA,  is  the 
descriptor  to  identify  the  entity  being  attributed  a  value.  The  term  information  asset  is 
very  ambiguous,  and  mostly  undefined  as  a  term,  but  is  commonly  found  in  the 
management  disciplines.  This  ambiguity  for  information  and  asset  stems  from  the 
separate  and  independent  use  of  the  words  which  does  not  necessitate  a  precise  definition 
for  information  asset  as  a  complete  term.  Prominent  information  and  knowledge 
management  leaders,  including  Thomas  Davenport,  Laurence  Prusak,  and  Peter  Drucker, 
defined  data  as  objective  facts  that  takes  shape  when  context  forms  information;  and,  the 
addition  of  personal  values,  experiences,  and  insight  forms  knowledge  (Drucker  1993; 
Davenport  and  Prusak  2000).  The  recognition  of  information  as  an  entity  within  the 
business  mainstream,  whether  originating  with  an  accountant  or  a  master  business 
administrator,  has  led  to  the  close  attachment  of  the  term  information  to  the  term  asset. 
However,  information  asset  is  not  defined  and  the  reader  is  left  to  assume  the  meaning  of 
information  asset.  Information,  as  Davenport,  Prusak,  and  Drucker  identified,  is  a 
compilation  of  data  within  a  context  and  an  asset  is  something  having  value  to  an  entity. 

Information  asset,  as  a  term,  creates  many  avenues  of  definition  possibilities.  The 
following  scenario  is  based  on  the  following:  Corporation  Alpha  is  a  widget  maker; 
Alpha  has  a  selling  staff  that  utilizes  a  sales  contact  listing  (SCL)  composed  of 
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prospective  and  existing  clients  that  need  widgets;  and,  the  SCL  is  maintained  on  the 
SCL1000  database  server.  The  first  view  of  information  asset  may  be  the  information 
itself  in  the  form  of  the  SCL  with  which  Alpha  generates  revenue.  A  second  view  of  an 
information  asset  may  be  the  sales  staff  that  initiate  and  maintain  close  relationships  with 
the  SCL  clients  that  provide  the  revenue.  A  third  view  is  that  the  information  asset  may 
be  the  SCL  1000  database  server  on  the  internal  network  for  sales  staff  to  access  or  the 
flow  of  the  SCL  back  and  forth  from  the  SCL  1000  through  the  network  to  the  sales 
staffs  computer  terminals.  A  fourth  view  may  be  that  the  SCL  has  intrinsic  qualities 
because  it  provides  a  revenue  generating  capability  that  Alpha’s  competitors  do  not  own. 
This  example  demonstrates  that  an  information  asset  may  be  the  information  itself,  the 
flow  of  information,  or  intangible  characteristics. 

An  information  asset  is  more  than  just  information  tangibles  such  as  static 
information,  physical  servers,  or  digital  documents.  Information  does  have  value  unto 
itself,  as  do  the  systems  that  process  that  information.  The  system  of  systems  creates  a 
situation  where  a  single  functional  quantity  of  information  may  span  across  a  labyrinth  of 
computers,  circuits,  routers,  geo-locations  and  provide  an  intrinsic  advantage  to  the 
individual  or  organization.  The  failure  of  any  one  of  these  smaller  components  will  result 
in  the  degradation  or  failure  of  that  information  process.  For  the  purposes  of  this  research 
an  information  asset  (InfoA)  is  the  combination  of  tangible  assets  (servers,  circuits,  data) 
and  intangible  assets  (synergy,  information,  knowledge)  that  span  internal  and  external 
organizational  boundaries  to  create  an  interdependent  system  without  form,  substance,  or 
physical  presence.  An  InfoA  is  the  convergence  of  information  tangibles,  information 
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intangibles,  and  information  flow  to  materialize  as  a  functional  entity  that  enhances  the 
mission  capability,  as  illustrated  in  Figure  3. 


Figure  3.  Conceptual  InfoA 


Research  Scope 

The  scope  of  developing  quantification  of  an  InfoA  to  a  useable  value  as  a 
research  topic  can  be  a  limitless  endeavor.  However,  the  ability  to  model  InfoA  valuation 
may  prove  to  be  severely  important  in  achieving  the  desperately  needed  capability  of 
cyber  battlespace  awareness  and  therefore  must  be  addressed,  discussed,  and  researched. 
As  a  concept,  the  IAV  methodology  is  applicable  to  modem  society  on  the  whole  through 
the  many  network-connected  and  driven-businesses,  the  banking  industry,  and  the  U.S. 
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Government;  moreover,  an  examination  of  all  these  could  lead  to  a  situation  of  never 
ending  analysis.  Refinement  of  a  manageable  research  topic  area  and  research  question 
was  provided  with  the  focus  of  the  CIMIA  project  on  the  DoD,  specifically  on  the  AF. 
Embedding  knowledge  and  experience  into  DSS  tools,  such  as  CIMIA,  will  enable 
planners  and  commanders  in  tactical,  operational,  and  strategic  levels  of  command  to 
interact  with  the  cyber  environment;  resulting  in  the  application  of  another  level  of 
refinement.  The  valuation  of  InfoAs  will  provide  the  capability  to  interact  with  the  cyber 
environment  in  the  past  through  historical  event  analysis,  in  the  present  with  near  real¬ 
time  alerts,  as  well  as  in  the  future  through  what-if  driven  scenario  development. 
Achieving  this  level  of  cyber  awareness  calls  for  a  multi-step  methodology  including: 
developing  factors,  scaling  factors,  aggregating  factor  values,  aggregating  across  InfoA 
values,  and  binding  InfoA  values  to  mission  impact.  The  true  scope  and  focus  of  the  IAV 
methodology  is  on,  and  for,  the  personnel  who  perform  against  the  natural  order  of  the 
existing  system  to  establish  the  communications  and  operations  InfoA  valuations  every 
day  with  archaic,  manual,  and  cumbersome  practices. 

Chapter  Summary 

In  this  chapter,  the  need  for  an  Information  Asset  Valuation  (IAV)  methodology 
was  presented  to  motivate  the  research.  Value  is  currently  playing  a  role  in  the 
information  asset  (InfoA)  prioritization,  however  the  details,  characteristics,  and 
arrangement  of  this  role  is  uncertain.  The  IAV  methodology  proposes  the  InfoA  term 
definition  as  the  convergence  of  information  tangibles,  information  intangibles,  and 
information  flow  to  materialize  as  a  functional  entity  that  enhances  the  mission  capability 
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through  physical  and  intrinsic  contribution.  Existing  non-military  and  military  valuation 
models  are  examined  for  adaptability  to  the  IAV  methodology.  The  IAV  methodology  is 
an  attempt  to  assist  the  AF  by  providing  an  understanding  of  friendly  InfoAs  actively 
being  utilized  in  the  cyber  domain  and  the  association  InfoAs  have  to  mission  impact  via 
an  automated  DSS  tool,  CIMIA.  Furthermore,  this  research  will  provide  insight  to  future 
research  efforts  at  understanding  the  criticality  of  adversarial  information  dependencies. 
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II.  Literature  Review 


Chapter  Overview 

In  this  chapter,  a  literature  review  is  conducted  of  various  public  and  government 
sector  discipline  models  for  adaptation  to  valuing  an  InfoA:  accounting  models,  legal 
models,  and  military  models.  In  this  chapter  is  the  foundation  of  research  contributing  to 
analysis  discussed  in  later  chapters,  as  illustrated  in  Figure  4. 
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Figure  4.  Literature  Research  Graphic 
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Accounting  Discipline  Models 

The  accounting  discipline  is  well  known  for  tracking  and  valuing  tangible 
business  assets,  such  as  equipment,  and  this  discipline  also  provides  tracking  and  valuing 
for  intangible  assets.  The  very  definition  of  InfoA  includes  both  tangible  and  intangible 
characteristics  to  formula  valuation.  Financial,  or  business  valuation,  is  the  umbrella 
term  for  the  accounting  area  dealing  with  many  intangible  asset  valuation  approaches  that 
may  apply  to  InfoA  valuation.  Two  additional  accounting  areas  that  may  apply  to  InfoA 
valuation  are  receivables  for  bad  debt  and  subjective  analysis.  The  accounting  discipline 
values  intangibles  through  market  value,  equivalent  item  comparisons,  categorization, 
statistical  calculations,  and  subjectivity. 

Intangible  Asset 

Intangible  assets  are  “non-physical  assets  such  as  franchises,  trademarks,  patents, 
copyrights,  goodwill,  equities,  mineral  rights,  securities  and  contracts  (as  distinguished 
from  physical  assets)  that  grant  rights  and  privileges,  and  have  value  for  the  owner,” 
(IGBV  2007),  and  “assets  (not  including  financial  assets)  that  lack  physical  substance,” 
(FASB142  2001:105).  The  accounting  discipline’s  governing  body  identifies  twenty- 
nine  intangible  assets  classes  (see  Appendix  A)  ranging  from  patents  representing  ideas 
to  ownership  of  the  oxygen  we  breathe  (Bossaerts  2001 :28). 

Financial  Accounting  Approaches 

Financial  accounting  addresses  the  valuation  of  intangible  assets  like  Info  As  and 
is  divided  into  three  approaches:  1)  market  or  market  comparable  approach,  where  the 
costs  of  similar  assets  being  sold  are  compared;  2)  cost  or  asset  approach,  where  the  cost 
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is  determined  by  what  a  willing  buyer  would  pay  for  the  asset;  and  3)  income  approach, 
where  the  value  is  determined  by  how  much  revenue  may  be  created  from  intangibles 
such  as  patents  (King  2002:75;  Hitchner  2003:7).  Although  each  approach  may  be 
available  for  valuation,  the  income  approach  most  directly  deals  with  intangible  asset 
valuation.  The  income  approach  is  further  divided  into  the  sub-approaches  of  valuation: 
Fair  Market  Value  (FMV),  Brand/Trade  Names/Trademarks  Value,  Goodwill/Residual 
Value  (King  2002;  Hitchner  2003;  Roche  2005),  Investment/Intrinsic  Value  (Hitchner 
2003;  Roche  2005),  Software  Value  (Hitchner  2003;  King  2006),  Research  and 
Development  Value  (R&DV)  (Roche  2005;  King  2006). 

Fair  Market  Value  (FMV) 

Fair  Market  Value  (FMV)  is  “the  price  at  which  the  property  would  change  hands 
between  a  willing  buyer  having  reasonable  knowledge  of  relevant  facts,”  (TR  2007). 

FMV  is  also  commonly  known  as  the  Fair  Value  (FV).  FV  is  “the  amount  at  which  an 
asset  could  be  bought  or  sold  in  a  current  transaction  between  willing  parties,  that  is  other 
than  in  a  forced  or  liquidation  sale,”  (Bossaerts  2001 : 106).  The  FMV  valuation  process 
requires  a  market  with  a  willing  buyer  and  seller  who  conduct  an  economic  transaction  to 
establish  value;  moreover,  comparing  similar  items  is  the  foundation  of  this  valuation 
approach.  A  very  good  example  of  an  intangible  asset  that  utilizes  the  FMV  approach  is 
found  in  the  area  of  intellectual  property  valuation.  Intangible  assets,  such  as  intellectual 
property  “are  most  generally  valued  through  the  fair  market  value  (FMV)  approach  which 
is  the  result  of  what  others  in  the  market  place  have  judged  the  value  to  be”,  and  “where 
the  public  market  does  not  exist,  the  application  of  FMV  becomes  progressively  more 
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judgmental  and  less  reliable,”  (Roche  2005:128).  FMY  utilizes  a  comparative  analysis  to 
determine  intangible  asset  value. 

Goodwill/Residual 

Goodwill  is  the  amount  of  residual  value  left  when  every  other  business 
component  has  been  removed  from  the  whole  value  and  may  “sometimes  be  used  to 
describe  the  aggregate  of  all  intangible  assets  of  a  business,”  (Hitchner  2003:813). 
Residual  value  takes  the  value  of  the  whole  company,  subtracts  all  tangible  and  intangible 
assets  from  the  business  sell  price,  then  the  leftover  value  is  attributed  the  intangible  asset 
of  goodwill  (Roche  2005:125;  King  2006:10).  For  example,  if  a  company  has  a  purchase 
price  of  $1,000  with  tangible  assets  worth  $800  and  intangible  assets  worth  $100,  then 
goodwill  is  $100  ($1000  -  $800  -  $100  =  $100).  In  the  aggregate  group  approach,  $200 
($100  +  $100)  worth  of  intangible  assets  and  goodwill  are  divided  among  the  total 
number  of  intangible  assets. 

Investment/Intrinsic 

Investment  value  is  “the  value  to  a  particular  investor,  which  reflects  the 
particular  and  specific  attributes  of  that  investor,”  (Hitchner  2003:5).  Intrinsic  value,  “the 
value  that  an  investor  considers,  on  the  basis  of  an  evaluation  or  available  facts,  to  be  the 
true  or  real  value  that  will  become  the  market  value  when  other  investors  reach  the  same 
conclusion,”  (IGBV  2007),  and  investment  value,  are  similar  approaches.  The  key  for 
both  of  these  approaches  is  the  development  of  a  personally  internal,  subjective  factor  for 
establishing  value.  For  example,  one  person  may  determine  that  color  is  the  most 
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important  factor  when  purchasing  a  vehicle  where  another  person  may  determine  that  the 
sound  of  a  vehicle’s  engine  is  the  most  important  factor. 

Research  and  Development  (R&D) 

Research  and  Development  (R&D)  utilizes  the  two  valuation  approaches  for  in- 
process  R&D  and  new  technologies:  1)  Capital  Asset  Pricing  Model  (CAPM)  or  the 
alternate  CAPM,  and  2)  estimation.  The  CAPM  utilizes  a  beta  measurement  taken  over 
at  least  60  increments  such  as  daily,  weekly,  or  monthly,  to  provided  a  statistical  average 
value,  and  the  alternative  CAPM  requires  “at  least  three  separate  CAPM  calculations 
(low,  medium,  and  high)  with  an  assigned  probability  of  occurrence,”  (Roche  2005:63). 
Even  with  statistical  support,  estimation  of  an  intangible  asset  is  an  “educated  guess  that 
is  often  the  only  solution,  recognizing  that  the  margin  for  error  may  be  significant,” 
(Roche  2005:129). 

Software 

Coding  rate  is  the  driver  behind  software  valuation  and  follows  a  three  step 
approach:  1)  determine  the  number  of  lines  of  code  a  programmer  creates  within  a  time 
window  like  a  single  hour  to  establish  the  code  rate,  2)  divide  the  total  number  of  code 
lines  within  the  software  by  the  coding  rate,  and  3)  multiply  the  number  of  hours  by  the 
lines  of  code  required  (Hitchner  2003:789).  For  example,  in  a  situation  with  10,000  lines 
of  code,  a  programmer  with  a  coding  rate  of  2  lines  per  hour,  and  a  programmer  with  a 
pay  rate  of  $30  an  hour  would  have  a  software  value  of  $150,000  (  10,000/2  =  5,000 
hours;  5,000  hours  *  $30  =  $150,000). 
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Trademark,  Brand  Name/I rade  Name 


Brand  or  trade  names  and  trademarks  generally  utilize  two  approaches  for 
valuation:  1)  direct  cash  flow  analysis,  and  2)  relief  from  royalty.  Direct  cash  flow 
utilizes  Weighted  Average  Cost  of  Capital  (WACC)  where  a  5-year  projection  is 
multiplied  by  a  weighted  debt-to-equity  ratio  (King  2006: 129).  Relief  from  royalty  is 
determined  by  answering  the  question,  “how  much  would  the  owner  of  the  trade  name 
pay  to  keep  the  use  of  the  name  or  if  the  owner  lost  the  right  to  utilize  the  name  for  a  5- 
year  period,”  (Hitchner  2003:80).  For  example,  a  large  company  like  Disney  would 
determine  how  much  it  would  pay  to  retain  the  use  of  the  Disney  brand  name  if  Disney 
were  to  lose  the  Disney  brand  name.  This  valuation  is  an  “estimate  of  what  the  brand 
name  itself  does  from  the  perspective  of  the  customer,”  and  “it  should  be  recognized  that 
the  estimate  of  the  price. .  .is  still  just  that — an  estimate,”  (King  2002: 15). 

Receivables  for  Bad  Debt  Approach 

Receivables  for  bad  debt  is  a  statistical  approach  to  determining  intangible  asset 
value  because  “we  know  a  certain  percentage  of  our  customers  will  not  pay,  but  we  do 
not  know  in  advance  which  they  will  be,”  (King  2006:278).  The  receivable  for  bad  debt 
approach  establishes  value  through  creation  of  a  statistical  percentage  representing  the 
number  of  accounts  that  will  potentially  default  during  the  year.  A  second  sub-approach 
“is  to  look  at  what  a  factoring  company  would  pay  because  factoring  companies  actually 
buy  receivables  for  cash”  and  this  transaction  for  the  purchase  of  receivable  for  bad  debt 
establishes  a  value  (King  2006:280). 


20 


Subjective  Analysis  Approach 

In  many  instances,  valuation  for  intangible  assets  is  a  subjective  assumption 
supported  by  a  defensible  methodology.  Some  valuation  experts  see  the  assumption 
approaches  as  “the  appraiser  makes  the  assumption,  or  the  client  makes  the  assumption,” 
(King  2002:143),  and  some  negotiation  occurs  to  establish  the  value.  Alfred  M.  King, 
appraiser,  and  financial  valuation  expert  states:  “Determining  values  for  intangible  assets 
requires  judgment  and  a  lot  of  assumptions  go  into  any  valuation.  These  assumptions 
deal  with  the  future  and  it  is  common  for  appraiser  to  state  that  valuation  is  an  art,  not  a 
science (King  2002: 143).  To  further  the  point  of  subjective  valuation  “the  Federal 
Accounting  Standards  Board  (FASB)  has  specified  that  appraisers  should  determine  the 
amount  that  market  participants  would  pay  for  the  intangible  asset.  In  effect  it  is  up  to 
the  appraiser  to  estimate  what  the  intangible  asset(s)  would  be  worth  to  other  than  the 
actual  buyer,”  (King  2002:xv,  18;  King  2006:176).  Taken  in  combination,  professional 
judgments  based  on  personnel  having  gained  experience  and  knowledge  of  the  subject  is 
at  the  forefront  of  appropriateness  in  the  valuation  process.  Intangible  assets  have  a 
similarity  with  tangible  assets  “like  tangible  property,  intellectual  property  can  be  bought, 
sold,  and  rented.  Also  like  tangible  property,  it  can  be  lost  or  destroyed  through 
carelessness  or  neglect”  and  “this  value  is  often  overlooked,  underestimated,  and 
underreported,”  (Poltorak  and  Lemer  2002:xiii).  When  dissecting  the  value  or  valuation, 
“value  is  the  degree  of  usefulness  or  desirability  of  something,  especially  in  comparison 
with  other  things  where  valuation  is  an  assessment  or  measurement  of  something  with 
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respect  to  its  embodiment  of  a  certain  value,”  (Andreissen  2004:18).  Intellectual  property 
is  generally  recognized  as  trademarks/service  marks,  patents,  and  copyrights. 

Accounting  Discipline  Models  Summary 

Valuation  of  information  is  an  intangible  asset  that  FASB  141  defines  and  FASB 
142  defines  the  specific  monetary  and  non-monetary  assessment  method.  Valuation  of 
intangibles,  such  as  InfoAs,  within  the  accounting  discipline  has  been  developed  and 
proven  over  time  to  be  trusted  assessment  methodologies  such  as  monetary  market 
values,  equivalent  item  comparisons,  categorization,  statistical  calculations,  and 
subjectivity.  Specifically,  the  accounting  discipline  utilizes  both  tangible  and  intangible 
methods  for  valuing  assets  such  as  FMV,  goodwill,  investment,  intrinsic,  research  and 
development,  software,  trademark,  receivables  for  bad  debt,  and  subjective  analysis. 

Legal  Discipline  Models 

This  literature  review  will  examine  the  intangible  asset  valuation  process  through 
the  legal  discipline  in  the  two  main  areas  such  as  intellectual  property  infringement,  and 
natural  resource  damages.  Attorneys  may  be  present  during  the  initial  valuation  of 
intangible  assets,  such  as  registering  patents,  but  attorneys  are  most  prevalent  during 
situations  where  intangible  assets  have  come  to  some  injury  such  as  infringement  or 
damages  assessment.  An  examination  of  the  Uniform  Commercial  Code  (UCC),  United 
States  Codes  (USC),  and  Comprehensive  Environmental  Response  Compensation  and 
Liability  Act  of  1980  (CERCLA)  will  provide  a  better  understanding  of  how  the  legal 
objective  and  subjective  methods  for  valuation  may  be  adapted  to  the  IAV  model. 
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Uniform  Commercial  Code  (UCC) 

The  UCC  is  the  foundational  guidance  standardizing  commerce  issues  across  state 
boundaries.  The  definition  for  intangible  asset  is  viewed  by  the  UCC  as  “General 
Intangible”  and  found  in  Article  9,  Secured  Transactions,  subpart  9-102(a)(42)  Index  of 
definitions,  as  “any  personal  property,  including  things  in  action,  other  than  accounts, 
chattel  paper,  commercial  tort  claims,  deposit  accounts,  documents,  goods,  instruments, 
investment  property,  letter-of-credit  rights,  letters  of  credit,  money,  and  oil,  gas,  or  other 
minerals  before  extraction,”  (UCC  2004). 

The  UCC  definition  for  intangible  asset  is  more  effective  at  describing  what  an 
intangible  is  not  than  what  an  intangible  is,  such  as  intellectual  property.  Intellectual 
Property  (IP)  is  simply  a  broad  category  for  intangible  items  lacking  the  standard 
physical,  distinguishable  substance  where  valuation  is  through  a  residual  or  second-hand 
method.  IP  includes  patents,  copyrights,  and  trademarks,  also  known  as  servicemarks, 
are  documented  in  many  laws  and  statues  such  as  the  Copyright  Act  of  1976,  the  Digital 
Millennium  Act  of  1998,  and  the  Family  Entertainment  and  Copyright  Act  of  2005  and 
the  United  States  Patent  and  Trademark  Office  (USPTO),  (CA1976  1976;  DMCA  1998; 
FECA  2005;  USPTO  2005). 

U.  S.  C.  Title  18,  Sections  1831-9  Trade  Secret  Protection 

Trade  secrets  are  a  form  of  intellectual  property  patents,  copyrights,  and 
trademarks.  Although  trade  secrets  have  long  been  in  use  the  government  provide 
significant  statutory  protection  until  the  Economic  Espionage  Act  of  1996,  and  inclusion 


23 


to  USC  18  Crime  and  Criminal  Procedures  (USC18§1831-9  1996).  A  trade  secret  is 
defined  by  USC  18  as: 


the  term  "trade  secret"  means  all  forms  and  types  of financial,  business, 
scientific,  technical,  economic,  or  engineering  information,  including 
patterns,  plans,  compilations,  program  devices,  formulas,  designs, 
prototypes,  methods,  techniques,  processes,  procedures,  programs,  or 
codes,  whether  tangible  or  intangible,  and  whether  or  how  stored, 
compiled,  or  memorialized  physically,  electronically,  graphically, 
photographically,  or  in  writing  if  (A)  the  owner  thereof  has  taken 
reasonable  measures  to  keep  such  information  secret;  and  (B)  the 
information  derives  independent  economic  value,  (USC18§1831-9  1996). 


Trade  secrets  infringement  entering  the  legal  system  and  when  offenders  are 
found  guilty,  are  assessed  and  sentenced  based  on  the  judgment  of  the  court  with 
penalties  ranging  from  forfeiture  of  illegal  gains  to  criminal  penalties  with  fines  and 
confinement  (USC  18§  183 1-9  1996). 

Patents 

Patents  are  the  method  for  protecting  the  ideas  of  individuals  found  in  commonly 
utilized  products  and  services.  The  USPTO  definition  of  a  patent  is  “the  granting  of  a 
property  rights  to  the  inventor,”  and  the  USPTO  further  describes  the  patent  right  as 
“excluding  others  from  making,  using,  offering  for  sale,  or  selling,  or  importing  the 
invention  into  the  United  States,”  (USPTO  2005).  The  USPTO  identifies  three  types  of 
patents:  1)  Utility  patent,  approved  for  people  who  “  invent  or  discover  any  new  and 
useful  process,  machine,  article  of  manufacture,  or  composition  of  matter”  or  create  an 
improvement  for  another  invention;  2)  Design  patent,  approved  for  people  who  “invent  a 
new,  original,  and  ornamental  design  for  an  article  of  manufacture”;  and  3)  Plant  patent, 
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approved  for  people  who  “invent  or  discover  and  asexually  reproduction  of  any  distinct 
and  new  variety  of  plant”(USPTO  2005). 

Copyrights 

Copyrights  are  the  method  for  protecting  the  ideas  of  people  seen  and  heard  in 
writings  and  recordings.  A  copyright  is  the  protection  of  an  author’s  “original  works  of 
authorship  including  literary,  dramatic,  musical,  artistic,  and  certain  other  intellectual 
works,  both  published  and  unpublished,”  (USPTO  2005).  The  copyright  owner  has  the 
exclusive  right  “to  reproduce  the  copyrighted  work,  to  prepare  derivative  work,  to 
distribute  copies  or  phonorecords  of  the  copyrighted  work,  to  perform  the  copyrighted 
work  publicly,  or  to  display  the  copyrighted  work  publicly,”  (USPTO  2005). 

Trademarks/Servicemarks 

Trademarks  are  those  monikers  associated  with  given  products  or  services. 
Trademark,  or  servicemark,  is  a  “word,  name,  symbol,  or  device  that  is  used  in  trade  with 
goods  to  indicate  the  source  of  the  goods  and  to  distinguish  them  from  the  goods  of 
others  with  a  servicemark  identifying  a  service  rather  than  a  product;”  furthermore,  the 
owner  receives  exclusive  right  “to  prevent  others  from  using  a  confusingly  similar  mark, 
but  not  to  prevent  others  from  making  the  same  goods  or  from  selling  the  same  goods  or 
services  under  a  clearly  different  mark,”  (USPTO  2005). 

Infringement 

The  legal  environment  does  not  usually  engage  with  the  initial  valuation  of  an 
intangible  asset  but  does  engage  with  valuation  in  the  form  of  infringement,  damage  and 
award.  The  foundation  of  an  attorney’s  involvement  with  intangible  asset  valuation  relies 
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on  some  occurrence  of  wrong  or  injury  with  the  intangible  asset,  such  as  infringement. 
The  infringement  is  just  the  beginning  as  negotiation  between  parties  may  occur,  but, 
over  time,  litigation  may  allow  for  assessment  of  damage  and  award.  The  USPTO 
utilizes  patent  infringement  found  in  the  United  States  Codes  (USC)  as  a  broad 
infringement  definition  for  all  intellectual  property  and  intangible  assets  (USPTO  2005). 

U.  S.  C.  Title  35,  Section  271  Patent  Infringement 

Infringement  occurs  when  someone  other  than  the  intangible  asset  owner  attempts 
to  gain  from  the  intangible  asset  or  someone  other  than  the  owner  prevents  a  gain  by  the 
owner  from  the  intangible  asset.  The  intangible  asset  owner  is  frequently  referred  to  as 
the  claimant  because  the  owner  lodges  a  lawsuit  against  the  infringer.  An  infringer  is  the 
person,  corporation,  or  entity  who  infringes  upon  the  intangible  asset  owner.  The  USC 
utilizes  the  patent  infringement  statute  to  define  all  cases  of  infringement  against  the 
broad  category  of  intangible  assets  as  “whoever  without  authority  makes,  uses,  offers  to 
sell,  or  sells  any  patented  [copyrighted,  trademarked,  or  intellectual  property]  invention, 
within  the  United  States  or  imports  into  the  United  States  any  patented  invention  during 
the  term  of  the  patent  therefore,  infringes  the  patent,”  (USC35§271  2000).  A 
contributory  infringer  may  be  liable  for  knowingly  offering  to  sell  the  “component  of  a 
patented  machine,  manufacture,  combination  or  composition,  or  a  material  or  apparatus 
for  use  in  practicing  a  patented  process”  which  constitutes  a  material  part  of  the 
invention;  moreover,  the  contributory  infringing  applies  when  the  infringer  knowing 
adapts  the  invention  as  “suitable  for  substantial  non-infringing  use”  or  circumvents 
infringement  (Cooper,  Watson  et  al.  2000:1). 
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Recovery  by  the  claimant  from  the  infringer  is  accomplished  by  one  or  both  of  the 
possible  methods:  injunction  relief  and  damage.  Injunction  relief  from  infringement  is 
“granted  against  an  infringer  to  prevent  the  commercial  manufacture,  use,  offer  to  sell,  or 
sale  within  the  United  States  or  importation  into  the  United  States”.  The  second  form  of 
relief,  “damages  or  other  monetary  relief  may  be  awarded  against  an  infringer  only  if 
there  has  been  commercial  manufacture,  use,  offer  to  sell,  or  sale,”  (Cooper,  Watson  et  al. 
2000:2).  Specific  methods  for  making  a  determination  on  damages  is  covered  separate 
section  of  USC,  under  Title  35  Section  284,  but  “the  court  will  award  to  a  successful 
patent  infringement  plaintiff  damages  sufficient  to  place  the  plaintiff  in  the  position  that 
the  plaintiff  would  have  occupied  had  the  infringement  not  occurred,”  (Poltorak  and 
Lemer  2002:125) 

U.  S.  C.  Title  35,  Section  284  Patent  Damages 

Patent  damage  provides  a  method  for  valuing  an  intangible  asset  through 
assessment  of  a  monetary  device.  In  many  cases  the  damage  for  infringement  is  pre¬ 
defined  prior  to  any  occurrence  of  infringement.  There  are  three  key  characteristics  of 
this  methodology  for  valuation  of  intangible  assets:  1)  a  pre-determination  of  the 
valuation  standard,  2)  a  requirement  to  actively  think  ahead  in  developing  the  standard, 
and  3)  a  documentation  of  the  standard  enables  all  potential  parties  to  review  and 
interpret  the  valuation  process  prior  to  an  actionable  occurrence.  One  method  for 
assessing  damage  is  through  “the  court  awarding  damage  adequate  to  compensate  for  the 
infringement,  but  in  no  event  less  than  a  reasonable  royalty  for  the  use  made  of  the 
invention  by  the  infringer,”  (Berry  2004:35).  Reasonably  royalty  is  calculated  utilizing 
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the  previous  year’s  “not  to  exceed  6  years  for  profits  that  would  have  been  earned  by  the 
[claimant]  if  the  infringer  had  not  infringed,  or  is  established  by  the  prevailing  royalty 
standard  for  the  industry,”  (Rockman  2004:3 15).  Assessing  damage  may  be  the 
responsibility  of  the  jury  or  the  court  and  “in  either  event  the  court  may  increase  the 
damage  up  to  three  times  the  amount  found  or  assessed,”  (USC35§284  2000).  This 
method  enables  a  creation  of  value  for  intangible  assets  from  nothing.  For  example, 
should  a  corporation  begin  selling  the  same  recipe  of  soda  as  a  existing  brand,  the  jury  or 
the  court  may  access  the  damage  of  $1  million;  resulting  in  establishment  of  a  base  value 
for  the  intangible  at  $1  million.  Furthering  the  example,  the  judge,  or  court,  has  the 
authority  to  subjectively  determine  an  amount  for  triple  the  original  assessment  value,  or 
$3  million. 

U.  S.  C.  Title  17,  Section  504  Copyrights 

More  than  under  patent  infringement,  the  copyright  infringement  damage  is  very 
specific.  A  copyright  infringer  is  “liable  for  either:  1)  the  copyright  owner's  actual 
damage  and  any  additional  profits  of  the  infringer,  or  2)  statutory  damage,  as  actual 
damages  and  profits,”  (USC17  2000).  Damages  for  copyright  include  “only  of  the 
infringer's  gross  revenue,  and  the  infringer  is  required  to  prove  his  or  her  deductible 
expenses  and  the  elements  of  profit  attributable  to  factors  other  than  the  copyrighted 
work,”  (USC 17  2000).  The  claimant  my  elect  statutory  damage  at  any  time  prior  to  final 
judgment,  applying  to  every  individual  instance  of  infringement,  or  “a  sum  of  not  less 
than  $750,  or  more  than  $30,000,  as  the  court  considers  just,”  (USC17  2000).  In  the  case 
of  copyright  infringement  the  court  has  the  authority  to  consider  what  is  just  and  for  a 
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willfully  committed  infringement  the  court  may  increase  the  award  to  “a  sum  of  not  more 
than  $150,000,”  (USC17  2000).  Damage  is  a  method  of  compensation  to  the  claimant 
and  hopefully  prevents  the  infringer  from  “unfairly  benefiting  from  a  wrongful  act,” 

(USC 17  2000).  Similar  to  patent  infringement,  the  copyright  valuation  method 
establishes  a  value  from  nothing  by  providing  a  valuation  standard  prior  to  an  occurrence 
of  infringement. 

U.  S.  C.  Title  15,  Section  1117  Trademarks/Servicemarks 

Comparable  to  copyright  infringement,  the  damage  process  for  trademark  and 
servicemark  is  specific.  Claimants  may  recover  the  profits  the  infringer  gained  from  the 
wrongful  act  and  any  damage  sustained  by  the  claimant  as  a  result  of  the  infringement 
offense.  Assessment  of  damage  is  accomplished  by  the  court  “may  enter  judgment, 
according  to  the  circumstances  of  the  case,  for  any  sum  above  the  amount  found  as  actual 
damage,  not  exceeding  three  times  such  amount,”  (USC  15  2000).  The  subjective  nature 
of  the  court’s  assessment  is  highlighted  by  the  statement,  “if  the  court  shall  find  that  the 
amount  of  the  recovery  based  on  profits  is  either  inadequate  or  excessive  the  court  may  in 
its  discretion  enter  judgment  for  such  sum  as  the  court  shall  find  to  be  just,  according  to 
the  circumstances  of  the  case,”  (USC  15  2000).  The  specific  statutory  damages  are  an 
amount  of  “not  less  than  $500  or  more  than  $100,000”  per  separate  instance  of 
infringement,  or  in  cases  of  willful  and  wrongful  infringement,  “not  more  than 
$1,000,000”  per  instance  of  infringement  (USC  15  2000).  The  claimant  has  some  leeway 
to  determine  at  any  time,  prior  to  final  judgment,  a  replacement  of  actual  damage  with  an 
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assessment  of  “not  less  than  $1,000  and  not  more  than  $100,000”  per  instances  of 
infringement  as  the  “the  court  considers  just,”  (USC15  2000). 

Damages  for  Natural  Assets 

A  natural  asset,  or  the  environment,  is  another  area  of  law  where  damage  of  an 
intangible  asset  may  provide  a  valuation  model  and  the  statutory  foundation  for  natural 
asset  damage  is  the  Comprehensive  Environmental  Response  Compensation  and  Liability 
Act  of  1980  (CERCLA).  CERCLA  provides  intangible  asset  valuation  through 
assessment  model  as  “appropriate  remedial  strategy  that  is  selected  after  consideration  of 
a  range  of  alternatives  for  restoration,  rehabilitation,  replacement,  and/or  acquisition  of 
equivalent  resources,”  (Lee  and  Bridgen  2002:219).  Natural  assets  are  frequently  termed 
as  invaluable  but  “those  practicing  this  legal  discipline  argue  that  even  the  priceless  must 
be  valued  in  a  market-based  society;  for  without  valuation  there  will  not  be  appropriate 
protection  and  conservation  of  resource  for  future  generations,”  (Lee  and  Bridgen 
2002:281).  CERCLA  recognizes  several  methods  for  natural  asset  valuation:  direct 
method,  scaling,  economic  loss. 

Economic  loss  is  the  “loss  of  business  revenue  occasioned  by  a  products’  failure 
to  perform  as  expected  or  the  inability  to  conduct  business  profitably  for  a  period  of 
time,”  (Madden  1992:48).  For  example,  a  polluted  lake  would  impact  the  camping 
revenue  for  the  period  that  campers  cannot  camp  near  the  lake.  The  direct  method,  very 
similar  to  economic  loss,  is  defined  as  “the  sum  of  losses  in  use  and  nonuse  values 
resulting  from  injury  to  the  quantity  of  quality  of  service  floes  of  the  natural  resource,” 
(Kopp  and  Smith  1993:204).  To  continue  the  camping  example,  the  direct  method 
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accounts  for  not  only  the  economic  loss  in  camping  revenue  but  also  the  potential  for 
camping  that  would  have  been  abundant  during  the  same  period.  The  direct  method 
accounts,  over  the  same  time  period,  for  both  the  projection  of  resource  use,  such  as  the 
current  season’s  worth  of  camping,  and  the  projection  potential  of  resource  use,  such  as 
the  current  season’s  maximum  camping  occupancy.  Scaling,  or  indirect  method, 
encompasses  several  methods  to  determine  value:  comparison,  adjusting  costs  from  a 
similar  project  to  meet  the  existing  asset;  probability,  using  expected  value  estimates  to 
determine  the  average ;  factor,  summing  the  product  of  several  income  items  or  activities; 
and,  standard  time  data,  estimating  the  standard  time  required  for  restoration  of  the 
natural  resource,  (Lee  and  Bridgen  2002:294). 

Legal  Discipline  Models  Summary 

The  legal  discipline,  driven  by  the  man  years  of  developing  legal  judgments,  has 
shown  an  in-depth  methodology  for  valuing  intangible  assets  in  both  a  tangible,  quantity 
aspects,  and  intangible,  qualitative  aspects.  Developing  legal  approaches  over  time 
through  statute  provide  a  subjective  but  trusted  valuation  methodology  for  information 
assets.  An  examination  of  intangible  valuation  process  through  legal  instruments  such  as 
UCC  infringement  statutes,  USC  patent,  copyright,  trademark/servicemark  and  trade 
secret  statues,  and  CERCLA  damage  assessment  method  will  provide  a  overall  better 
understanding  of  how  the  legal  objective  and  subjective  methods  for  valuation  may  be 
adapted  to  the  IAV  model. 
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Military  Models 

The  military  processes  are  being  reviewed  for  qualitative  measures  with 
defensible  subjective  methodologies  in  the  areas  of  Base  Civil  Engineering  Work  Order 
Management  (BCE-WOM),  Communications  Helpdesk  Trouble  Ticket  Management 
(HTTM),  Enlisted  Evaluation  System  (EES),  Classified  National  Security  Information 
(CNSI),  Operational  Security  (OPSEC),  Operational  Risk  Management  (ORM),  and 
Universal  Joint  Task  List  (UJTL). 

Base  Civil  Engineering  Work  Order  Management  (BCE-WOM) 

Base  Civil  Engineering  work  order  management  (BCE-WOM)  has  the 
responsibility  to  “manage,  control,  plan,  schedule,  and  program  work  requirements  by  the 
most  efficient  means”  in  terms  of  work  orders  as  defined  by  the  “scope  and  complexity  of 
the  requirement,”  (AFI32-1001  2005:4-6).  From  this  guidance  two  categories  have  been 
defined:  1)  Planned  Work,  “to  includes  minor  construction  where  the  planner  determines 
the  scope,  method,  and  type  of  resources”;  and  2)  Direct  Scheduled  Work,  “to  include 
work  that  generally  does  not  require  detailed  planning,”  (AFI32-1001  2005:4-6). 

Planned  work  orders  are  provided  with  four  priority  categories:  “Priority  1- 
Mission,  work  in  direct  support  of  the  overall  base  mission  that,  if  not  done,  would 
reduce  operational  effectiveness;  Priority  2-Safeguard  Life  and  Property,  work  needed  to 
give  adequate  security  to  areas  subject  to  compromise,  or  to  protect  valuable  property  or 
equipment;  Priority  3-Support,  work  that  supports  the  mission  or  prevents  a  breakdown 
of  essential  operating  or  housekeeping  functions;  and  Priority  4-Necessary,  not 
qualifying  for  higher  priority,”  (AFI32-1001  2005:4-6). 
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Direct  schedule  work  orders  are  also  provided  with  four  priority  categories: 
“Emergency,  work  required  to  eliminate  an  emergency  condition  within  24  hours  of 
notification  that  is  detrimental  to  the  mission  or  reduces  operational  effectiveness; 

Urgent,  work  that  is  not  an  emergency,  but  must  be  responded  to;  and  Routine,  work  that 
does  not  qualify  as  emergency  or  urgent  work,”  (AFI32-1001  2005:4-6). 

Communications  Helpdesk  Trouble  Ticket  Management  (HTTM) 

The  Communications  Helpdesk  trouble  ticket  management  (HTTM)  process  is  the 
focal  point  for  customers  needing  action  on,  and  response  to,  communication’s  process 
issues.  The  Helpdesk  is  assigned  the  task  of  providing  “network  assistance,  trouble 
resolution  and  will  be  based  on  a  fully  integrated  trouble  ticketing  system.  The  trouble 
ticketing  system  should  be  able  to  automatically  assign  priorities  and  set  response  times 
and  escalation  timelines  based  on  the  criticality  of  the  system  being  reported  on,”  (Lee 
and  Bridgen  2002:48;  AFI33-1 15 VI  2006:20-35).  In  no  less  than  three  hierarchical 
levels  of  Communications  Management,  Air  Force  Network  Operations  and  Security 
Center  (AFNOSC),  Network  Operations  and  Security  Center  (NOSC),  and  Network 
Control  Center  (NCC),  are  assigned  responsibly  to  “analyze  customer  impact  of  all 
network  incidents,  problems  and  alerts,  and  develop  corrective  actions,”  (AFI33-1 15 VI 
2006:20-35).  At  the  same  time  the  customer  is  directed  that  “during  a  trouble  call,  the 
end  users  will:  (3)  Provide  service  provider  with  a  description  of  problem,  its  priority, 
and  potential  mission  impact,”  (AFI33-1 15 VI  2006:74).  Trouble  ticket  priorities  are 
assigned  according  to  work  centers  for  jobs  under  their  control  utilizing  mission  impacts 
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to  determine  the  priority,”  (AFI33-1 15V1  2006:41).  The  methodology  being  employed 
for  helpdesk  trouble  ticket  processes  relies  on  local  development  of  qualitative  measures. 

Enlisted  Evaluation  System  (EES) 

The  Enlisted  Evaluation  System  (EES)  process  tracks  personnel  behavior  against 
qualitative  measures  with  the  two  steps  of  performance  feedback  and  performance 
reporting.  The  purpose  of  the  EES  is  three-fold:  1)  establish  individual  expectations, 
achievement  of  expectation,  and  improvement  at  achieving  expectations;  2)  establish  a 
long-term  history  of  performance;  and  3)  provide  comparable  records  for  promotion 
boards  (AFI21-1 16  2005:6).  Performance  is  the  key  evaluation  standard  reflecting  how 
well  “the  individual  does  his  or  her  job,  and  the  qualities  the  individual  brings  to  the  job” 
and  is  “most  important  for  successful  mission  accomplishment,”  (AFI36-2406  2005:6). 
EES  represents  the  epitome  of  human  behavior  quantification  because  EES  looks  to 
categories  the  spectrum  of  standards  from  worst  performance  to  best  performance 
through  supervisory  judgment. 

The  first  step  in  EES  is  accomplishment  of  the  performance  feedback  worksheet 
(PFW)  which  is  utilized  to  establish  communication  and  roles  between  the  rater  and  ratee. 
The  two  versions  of  the  PFW,  one  for  lower  and  one  for  higher  enlisted  ranks,  share  the 
assessment  areas  of:  1)  Primary  Duties,  with  the  supervisor  considering  adapting, 
learning,  quality,  quantity,  timeless,  technical  knowledge,  leading,  professional  growth, 
communication  skills,  and  managing  and  supervising;  2)  Standards  Enforcement  and 
Personal  Adherence,  Conduct,  Character,  Military  Bearing,  Customs  and  Courtesies  with 
the  supervisor  considering  enforcement  and  personal  adherence,  dress  and  appearance, 
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and  personal  and  professional  conduct  on  and  off  duty;  3)  Resource  Management  and 
Decision  Making,  with  the  supervisor  considering  efficiency,  judgment,  setting  and 
meeting  goals;  4)  Training,  Education,  Off-duty  Education,  Professional  Military 
Education  (PME),  Professional  Enhancement  and  Communication,  with  the  supervisor 
considering  ancillary,  on-the-job,  readiness,  providing,  supporting  and  personal  growth; 
and  5)  Leadership,  Team  Building,  Follwership,  and  Mentorship,  with  the  supervisor 
considering  team  accomplishments,  leveraging  personal  experience  and  community 
support,  and  recognition  and  reward  for  others  (AFForm931  2007;  AFForm932  2007). 
These  five  subjective  PFW  categories  on  performance  rating  are  then  measured  with  the 
threshold  standards  of:  “does  not  meet,”  “meets,”  “above  average,”  and,  “clearly 
exceeds,”  (AFForm931  2007;  AFForm932  2007). 

The  second  step  of  the  EES  is  documentation  of  performance  with  the  Enlisted 
Performance  Report  (EPR).  The  PFW  and  the  EPR  are  nearly  identical  to  provide  a 
strong  bond  between  the  two  tools;  however  the  EPR  differs  significantly  with  a  category 
for  overall  performance  assessment.  The  overall  subjective  assessment  threshold 
standard  categories  are:  “poor,”  “needs  improvement,”  “average,”  “above  average,”  and, 
“truly  among  the  best,”  (AFForm910  2007;  AFForm91 1  2007). 

Classified  National  Security  Information  (CNSI) 

The  Classified  National  Security  Information  (CNSI),  or  Executive  Order  (EO) 
13292,  process  establishes  a  standardized  system  for  “classifying,  safeguarding,  and 
declassifying  national  security  information,”  (EO  13292  2003:15315-9).  The  EO  defines 
who  may  classify  information,  and  the  qualitative  measures  for  information  classifying. 
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Who  may  classify  information  rests  in  the  two  parts  of:  classification  guide  and 
classification  authority.  The  classification  guide  establishes  the  rules  for  dealing  with 
specific  information  of  an  agency  to  “facilitate  the  proper  and  uniform  derivative 
classification  of  information,”  (E013292  2003:15315-9).  The  classification  guide 
development  is  a  requirement  of  the  classification  authority  or  the  “senior  agency 
official,”  (EO 13292  2003:15315-9). 

Three  qualitative  measurements  with  definitions  are  utilized  to  categorize 
information.  The  three  levels  are:  1)  Top  Secret  “shall  be  applied  to  information,  the 
unauthorized  disclosure  of  which  reasonably  could  be  expected  to  cause  exceptionally 
grave  damage  to  the  national  security,”  2)  Secret  “shall  be  applied  to  information,  the 
unauthorized  disclosure  of  which  reasonably  could  be  expected  to  cause  serious  damage 
to  the  national  security,”  and  3)  Confidential  “shall  be  applied  to  information,  the 
unauthorized  disclosure  of  which  reasonably  could  be  expected  to  cause  damage  to  the 
national  security,”  (EO  13292  2003:15315-9). 

Operational  Security  (OP SEC) 

The  purpose  of  Operational  Security  (OPSEC)  process,  from  an  AF  perspective, 
is  to  “reduce  the  vulnerability  of  AF  missions  from  successful  adversary  collection  and 
exploitation  of  critical  information”,  and  an  important  function  of  the  OPSEC  process  is 
the  “identification  of  critical  information  for  each  operation,  activity,  and  exercise 
planned,  conducted  or  supported,”  (AFI 10-701  2007:4).  The  OPSEC  requirement  for  the 
Critical  Information  Listing  (CIL),  also  known  as  Commander’s  Critical  Information 
Requirement  (CCIR)  or  Critical  Information  Program  (CIP),  positions  the  commander  to 
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judge  and  ensure  “CILs  are  developed  and  procedures  are  in  place  to  control  critical 
information  and  their  indicators,”  (AFI10-701  2007:9).  The  CIL  defines  categories  of 
“critical  information  as  specific  facts  about  friendly  intentions,  capabilities,  and  activities 
vitally  needed  by  adversaries  for  them  to  plan  and  act  effectively,  so  as  to  guarantee 
failure  or  unacceptable  consequences  for  friendly  mission  accomplishment;  best 
identified  by  the  individuals  responsible  for  the  planning  and  execution  of  the  unit’s 
mission”  such  as  an  “OWG  [Operations  Working  Group]  or  staff  planning  team,” 

(AFI 10-701  2007:12).  After  the  CIL  has  been  developed,  and  vetted,  the  “commander 
must  approve  the  list  and  then  ensure  their  critical  information  is  protected  and/or 
controlled,”  (AFI10-701  2007:12). 

Operational  Risk  Management  (ORM) 

The  Air  Force  Operational  Risk  Management  (ORM)  process  is  a  “decision¬ 
making  process  to  systematically  evaluate  possible  courses  of  action,  identify  risks  and 
benefits,  and  determine  the  best  course  of  action  for  any  given  situation,”  (AFI90-901 
2001 : 1-3).  ORM  allows  commanders  and  individuals  to  limit  risk  through  assessment  of 
an  activity’s  steps  such  as  flying,  a  joint  exercise,  loading  a  truck,  or  driving  home  at  the 
end  of  the  day,  “with  quantitative  or  qualitative  measures  to  determine  the  potential  of  ill 
effects  in  such  activities,”  (AFI90-901  2001:1-3).  ORM  utilizes  a  six  step  process 
highlighting  qualitative  measures  of  risk  assessment. 

ORM  functions  through  the  utilization  of  six  fundamental  steps,  as  illustrated  in 
Figure  5,  Operational  Risk  Management  Process,  (AFPAM90-902  2000:7).  ORM  Step  2, 
Assess  the  Risks,  utilizes  qualitative  measures  to  associate  hazards  with  risks  through  an 
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“estimation  of  probability,  severity,  and  exposure”  for  standardizing  the  comparison  of 
differing  risks  (AFPAM90-902  2000: 17).  The  development  of  risks  utilizes  the  three 
components  of:  1)  Probability  as  the  estimate  of  the  likelihood  that  a  hazard  will  cause  a 
loss,  2)  Severity  as  the  estimate  of  the  extent  of  loss  that  is  likely,  and  3)  Exposure  as  the 
number  of  personnel  or  resources  affected  by  a  given  event  or  over  time  (AFPAM90-902 
2000:17).  The  qualitative  measure  of  severity  categories  “provide  guidance  to  a  wide 
variety  of  missions  and  systems:  1)  Catastrophic,  complete  mission  failure,  death,  or  loss 
of  system;  2)  Critical,  major  mission  degradation,  severe  injury,  occupational  illness  or 
major  system  damage;  3)  Moderate,  minor  mission  degradation,  injury,  minor 
occupational  illness,  or  minor  system  damage;  and,  4)  Negligible,  less  than  minor 
mission  degradation,  injury,  occupational  illness,  or  minor  system  damage,”  (AFPAM90- 
902  2000:17). 


Figure  5.  Operational  Risk  Management  Process  (AFPAM90-902  2000:7) 
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Universal  Joint  Task  List  (UJTL) 

The  Universal  Joint  Task  List  (UJTL)  process  is  the  overall  guiding  joint 
document  with  military  service  specific  guidance  through  documents  such  as  the  Air 
Force  Master  Capabilities  List  (AFMCL),  Army  Universal  Task  List  (AUTL),  and 
Universal  Naval  Task  List  (UNTL).  UJTL  consists  of  “tasks,  conditions,  and  measures” 
enabling  tasks  to  be  “mapped  to  capabilities  to  meet  operational  mission  requirements,” 
(CJCSM3500.04D  2005:A1).  Categories  of  measurement  of  performance  rely  upon  the 
“commander’s  approved  measures  and  criteria  [to]  establish  task  standards  based  on 
mission  requirements,”  (CJCSM3500.04D  2005: A3).  Infrastructure  Maintenance 
provides  three  representative  qualitative  measures:  Low,  excess  infrastructure  capacity 
or  low  economic  needs  required  to  sustain  economy;  Moderate,  economy  capable  of 
withstanding  some  loss  of  infrastructure;  and  High,  full  infrastructure  required  to  sustain 
basic  economy,”  (CJCSM3500.04D  2005 :C80). 

Military  Models  Summary 

Valuation  of  intangible  such  as  information  asset  is  possible  with  the  time  tested 
and  developed  processes  utilized  in  the  military.  This  section  has  presented  a  review  of 
military  processes  for  qualitative  measures  with  defensible  subjective  methodologies  in 
the  areas  of  BCE-WOM,  Communications  HTTM,  EES,  CNSI,  OPSEC,  ORM,  and 
UJTL.  InfoA  valuation  requires  the  utilization  of  subjective  qualitative  measures  similar 
to  what  may  be  found  in  existing  military  sector  processes.  Qualitative  measure  for 
human  behavior  is  subjective  and  a  defensible  methodology  model  is  necessary  to 
establish  user  faith  in  the  InfoA  valuation  process. 
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Chapter  Summary 

Existing  models  of  subjective  qualitative  models  for  valuation  of  Info  As  from  the 
public  and  military  sectors  have  been  examined  for  adaptability  to  the  IAV  methodology. 
The  accounting,  legal,  and  military  models  from  this  chapter  are  the  foundation  of 
research  contributing  to  analysis  discussed  in  later  chapters.  Valuation  of  intangibles, 
such  as  InfoAs,  is  accomplished  in  the  accounting  discipline  with  proven  and  trusted 
methodologies  of  monetary  market  values,  equivalent  item  comparisons,  categorization, 
statistically  calculations,  and  subjectivity  such  as  FMV,  goodwill,  investment,  intrinsic, 
research  and  development,  software,  trademark,  receivables  for  bad  debt,  and  subjective 
analysis.  An  examination  of  intangible  valuation  process  with  legal  instruments  is 
accomplished  with  proven  and  trusted  methodologies  such  as  UCC,  USC,  and  CERCLA 
statutes.  InfoA  valuation,  with  or  without  the  IAV  methodology,  requires  the  utilization 
of  subjective  qualitative  measures  similar  to  what  may  be  found  in  existing  military 
sector  models  such  as  BCE-WOM,  Communications  HTTM,  EES,  CNSI,  OPSEC,  ORM, 
and  UJTL..  Qualitative  measure  for  human  behavior  is  subjective  and  a  defensible 
methodology  model  is  necessary  to  establish  user  faith  in  the  InfoA  valuation  process. 
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III.  Methodology 


Chapter  Overview 

Conducting  research  can  have  many  paths,  each  of  which  will  be,  and  should  be, 
critically  analyzed  for  accuracy,  legitimacy,  and  validity.  Finding  the  balance  within  a 
methodology  for  what  may  be  the  most  well  planned  design  versus  the  inherent  failings 
within  a  methodology  is  an  appropriate  tactic  to  ensure  new  information  comes  to  light  as 
well  as  preserve  the  integrity  of  the  information.  This  initial  research  is  a  social  science 
driven  study  for  application  of  human  behavior  in  the  valuation  of  Info  As  and  requires  an 
exploratory  qualitative  methodology.  This  chapter  will  discuss  the  methodological 
strategy,  approach,  and  application  of  this  research. 

Methodology  Strategy 

Choosing  the  most  effective  methodological  strategy  for  the  specific  research  is 
important  to  achieve  acceptance,  credibility,  and  reliability.  Many  methodologies  exist  to 
conduct  research  such  as  archival  analysis,  case  study,  or  phenomenological  study 
(Patton  1990:109;  Yin  2003:5;  Leedy  and  Ormrod  2005:68),  but  it  is  the  most  appropriate 
methodology  that  will  yield  the  best  contribution  to  the  body  of  literature.  The  research 
question  being  asked  can  identify  which  of  the  methodological  strategies  will  be  the  most 
effective  and  fruitful. 

Yin,  noted  research  design  and  methods  author,  identified  the  research 
possibilities  as  experiment,  survey,  archival  analysis,  history,  or  case  study;  moreover, 
determining  the  most  appropriate  research  method  may  be  accomplished  through  analysis 
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of  three  conditions,  as  illustrated  in  Table  1 :  1)  the  type  of  research  question  posed,  2)  the 
extent  of  control  an  investigator  has  over  actual  behavior  events,  and  3)  the  degree  of 
focus  on  contemporary  as  posed  to  historical  events  (Yin  2003:5). 


Table  1.  Relevant  Situations  for  Different  Research  Strategies  (Yin  2003:5) 


Strategy 

Form  of  Research 
Question 

Requires  Control  of 
Behavioral  Events? 

Focuses  on 

Contemporary  Events? 

Experiment 

How,  why? 

Yes 

Yes 

Survey 

Who,  what,  where,  how 
many,  how  much? 

No 

Yes 

Archival  analysis 

Who,  what,  where,  how 
many,  how  much? 

No 

Yes/No 

History 

How,  why? 

No 

No 

Case  Study 

How,  why? 

No 

Yes 

The  form  of  the  research  question  such  as  who,  what,  what,  how,  and  why  may  be 
used  to  distinguish  among  the  research  methods  (Yin  2003:5).  Valuation  of  is  a 
relatively  new  research  area  with  little  or  no  current  body  of  research,  process, 
framework,  or  methodology;  therefore,  research  into  this  area  is  initial  research.  This 
initial  research  looks  to  answer  questions  of  “how  does  this  work,”  and  “why  does  this 
work,”  and  for  both  the  experiment  and  the  survey  an  existing  level  of  research  is  needed 
in  order  to  prepare  valid  instruments  for  analysis.  Archival  analysis  questions  such  as 
“how  many,”  or  “how  much,”  deal  with  the  quantitative  measurements  which  are  not  as 
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compatible  with  social  sciences.  History  and  case  study  most  closely  match  the  nature  of 
the  IAY  methodology  by  asking  the  “how,”  and  “why,”  questions. 

The  level  of  behavior  control  that  may  be  exercised  in  the  research  highlights  two 
key  initial  investigative  research  elements.  These  elements  are  flexibility  for  looking  at 
all  forms  of  source  information  and  the  planning  of  an  unfettered  research  approach.  The 
case  study  provides  for  the  broad  range  of  investigative  sources  and  has  the  “unique 
strength. .  .to  deal  with  a  full  variety  of  evidence — documents,  artifacts,  interviews,  and 
observations — beyond  what  may  be  available  for  a  historic  study,”  (Yin  2003:8). 

Historic  and  case  study,  as  illustrated  in  Table  1,  match  the  little  or  no  exertion  of  control 
by  researcher  an  individual’s  internal  process  of  valuation. 

The  effect  of  contemporary  events  on  investigative  research  into  valuation  of  an 
InfoA  is  a  vital  issue  in  developing  a  research  design.  An  InfoA  by  definition  is  a  new 
idea  only  existing  in  the  contemporary  environment;  thus  precluding  historic  analysis  as  a 
research  method.  Additionally,  the  case  study  has  the  advantage  over  historic  research  in 
the  ability  of  “direct  observation  of  the  events  being  studied  and  interviews  of  the  person 
involved  in  the  events,”  (Yin  2003:8). 

The  case  study,  on  the  surface,  appears  to  satisfy  the  requirements  of  the  IAV 
exploratory  research;  however,  the  case  study  has  a  unit  of  analysis  issue.  An  integral 
part  of  the  case  study  methodology  is  the  unit  of  analysis  which  defines  “what  the  case 
is,”  (Yin  2003:22).  The  unit  of  analysis  defines  “what  is  actually  measured  or  studied  to 
test  the  hypothesis  and  it  is  not  the  variable  being  studied,”  (Sirkin  2006:25).  The  IAV 
exploratory  research  looks  to  uncover  the  unit  of  analysis  attribute  and  therefore  no  unit 
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of  analysis  has  yet  been  established.  The  resulting  lack  of  a  unit  of  analysis  precludes  a 
case  study  as  the  methodology.  The  importance  of  selecting  the  correct  methodological 
strategy  to  establish  fruitful  research  can  be  identified  by  the  research  question  that  needs 
to  be  answered. 

Methodology  Approach 

Selecting  the  correct  methodological  approach  for  researching  the  IAV 
methodology  requires  a  look  at  measurement.  A  measurable  scale  “assigns  numbers  to 
some  characteristic  of  an  observation  according  to  a  set  of  rules,”  (Porter  and  Hamm 
1986:5).  Measurement  can  be  defined  as  a  numerical  representation  of  length,  or  width, 
“but  also  other  simpler  actions  such  as  assignment  of  a  person  to  particular  category  of  a 
variable,  to  include  somewhat  different  things-assignment  by  category,”  (Sirkin  2006:34). 
IAV  relies  on  the  quantification  of  the  complex  and  unpredictable  behavior  of  human 
beings.  Quantitative  consists  of  a  measurable  quantity,  such  as  height  or  weight  or 
temperature,  and  complex  human  behaviors  are  not  well  captured  by  quantitative 
techniques  (Moore  1969:26;  Stevens  2007).  Qualitative  research  “assigns  [data]  to 
categories  that  do  not  imply  quantities”  much  like  for  unpredictable  behavior  such  as  an 
“opinion,”  (Moore  1969:5).  Understanding  the  measurement  characteristics  of  a 
qualitative  approach  over  a  quantitative  approach  is  appropriate  to  determine  the  most 
effective  methodological  approach. 

The  research  goal  has  the  characteristics  of  exploration,  description,  explanation, 
and  development  of  categorization  theory  for  the  IAV  model.  These  identified 
characteristics  are  perhaps  the  antithesis  of  the  quantitative  approach,  as  illustrated  in 
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Table  2;  however,  these  same  characteristics  lend  themselves  very  well  to  the  qualitative 
research  approach.  The  Leedy  and  Ormrod  expressed  qualitative  description  addresses 
many  of  the  criteria  necessary  for  the  IAV  methodology. 


Table  2.  Charac 

teristics  of  Approaches  (Leedy  and  Ormrod  2005:96) 

Question 

Quantitative 

Qualitative 

What  is  the  purpose  of  the 
research 

To  explain  and  predict 

To  confirm  and  validate 

To  test  theory 

To  describe  and  explain 

To  explore  and  interpret 

To  build  theory 

What  is  the  nature  of  the 
research  process? 

Focused 

Known  variables 

Established  guidelines 

Predetermined  methods 

Somewhat  context-free 

Detached  view 

Holistic 

Unknown  variables 

Flexible  guidelines 

Emergent  methods 

Context-bound 

Personal  view 

What  are  the  data  like,  and 
how  are  they  collected? 

Numeric  data 

Representative,  large  sample 

Standardized  instruments 

Textual  and/or  image-based  data 

Informative,  small  sample 

Loosely  structure  or  non- 
standardized  observations  and 
interviews 

How  are  data  analyzed  to 
determine  their  meaning? 

Statistical  analysis 

Stress  on  objectivity 

Deductive  reasoning 

Search  for  themes  and  categories 

Acknowledge  that  analysis  is 
subjective  and  potentially  biased 

Inductive  reasoning 

How  are  the  findings 
communicated? 

Numbers 

Statistics,  aggregated  data 

Formal  voice,  scientific  style 

Words 

Narratives,  individual  quotes 

Personal  voice,  literary  style 

Of  the  five  reasons  identified  for  performing  qualitative  research,  the  ones  with 
the  most  relevance  to  researching  the  IAV  methodology  are  “to  understand  a  new  or  little 
understood  problem,”  “the  nature  of  the  research  problem,”  and  “to  provide 
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understanding  of  the  details  in  complex  phenomena  that  cannot  be  easily  conveyed  with 
quantitative  methodology,”  (Strauss  and  Corbin  1990).  These  first  two  reasons  for 
qualitative  research  are  related  to  the  previously  addressed  issue  with  the  IAV 
methodology  being  a  new  research  area  with  little  or  no  current  research  body  of 
knowledge.  The  last  reason  for  qualitative  research  is  directly  related  to  the 
quantification  of  human  behavior  where  “reality  is  not  easily  divided  into  discrete, 
measurable  [quantitative]  variables,”  (Leedy  and  Ormrod  2005:96).  The  exploratory 
nature  of  explaining  the  IAV  methodology  lends  itself  to  an  approach  utilizing 
“measurement  instruments  (e.g.  interviews),  categories  (variables)  emerging  from  the 
data,  leading  to  “context-bound”  information,  patterns,  and/or  theories  that  help  to 
explain  the  phenomena  under  study,”  (Leedy  and  Ormrod  2005:95).  Understanding  the 
measurement  characteristic  of  a  qualitative  approach  over  quantitative  approach  is  most 
appropriate  “when  little  information  exists  on  a  topic,  when  variables  are  unknown,  when 
a  relevant  theory  base  is  inadequate  or  missing,  [and]  a  qualitative  study  can  help  define 
what  is  important — that  is,  what  need  s  to  be  studied,”  (Leedy  and  Ormrod  2005:95). 

Methodology  Application 

Research  into  the  IAV  process  relies  heavily  on  quantification  of  human  behavior 
and  development  of  a  new  research  area.  These  two  situations  compel  the  research  to 
deviate  from  commonly  accepted  and  overly  structured  research  methodologies.  The 
most  appropriate  methodology  is  an  exploratory  methodological  strategy  and  a  hybrid 
approach  by  taking  the  most  beneficial  portions  from  other  methodologies  with  a 
qualitative  approach.  As  illustrated  in  Figure  6,  this  research  has  been  conducted  in  the 
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multi-phase  of  a  qualitative  case  study  approach:  Focus  and  Design,  Prepare  and  Collect 
Data,  and  Analysis  and  Findings  (Patton  1990: 139;  Leedy  and  Ormrod  2005:68). 


Figure  6.  Methodological  Application 


Focus  and  Design 

The  focus  and  design  stage  is  predominantly  concerned  with  defining  the  purpose 
of,  establishing  a  design  for,  and  development  of  investigative  questions  for,  the  topic 
area  of  research. 

This  thesis  engages  with  the  research  question,  “What  is  the  process  for 
attributing  value  to  an  InfoA?”  The  goal  of  this  research  is  to  provide  a  better 
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understanding  of  how  the  process  of  valuation  occurs  and  the  results  utilized  for 
application  against  the  valuation  of  InfoAs.  An  understanding  of  the  valuation  process 
will  help  to  identify  factors,  or  qualitative  measures,  and  enable  a  standard  comparison 
scale  for  different  InfoAs.  The  underlying  general  question  is  “how  is  this  asset  valuation 
important?”  Understanding  the  valuation  process  and  being  able  to  apply  measures  of 
importance  to  InfoAs  will  provide  powerful  leverage  for  planning-to-execution  decision 
makers.  Additionally,  the  quantifiable  value,  or  criticality,  of  InfoAs  will  provide 
decision  makers  with  the  ability  to  determine  what  assets  to  protect,  conserve,  enhance, 
and  even  disregard. 

As  previously  discussed,  the  IAV  methodology  research  has  been  performed  as  a 
hybrid  of  the  most  beneficial  parts  of  other  methodologies  that  emphasize  a  qualitative 
approach.  The  methodological  approach  may  best  be  described  as  a  qualitative 
phenomenological  study  where  the  study  “attempts  to  understand  people’s  perspectives, 
and  understanding  of  a  particular  situation,”  (Patton  1990:139;  Leedy  and  Ormrod 
2005:68),  such  as  in  understanding  an  individual’s  perspective  on  valuation  of  an  InfoA. 

Development  of  a  potential  solution  for  the  IAV  methodology  has  been 
accomplished  through  the  following  research  and  investigative  questions: 

R.  What  is  the  process  for  attributing  value  to  an  information  asset? 

1.  What  is  an  information  asset  (InfoA)? 

2.  Can  qualitative  factors  establish  value? 

3.  Can  a  single  value  be  established  for  an  information  asset? 

4.  Can  one  information  asset  have  different  values ? 

5.  Are  academic  discipline  models  adaptable  to  information  asset  valuation? 
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Prepare  and  Collect  Data 

In  this  stage  the  three  potential  qualitative  approaches  to  preparation  and 
collection  of  data  are  “in-depth  open-ended  interviews,  direct  observations,  and  written 
documents,”  (Patton  1990: 10).  The  research  began  with  investigative  subject  matter 
expert  interviews  from  both  the  private  and  military  sectors  to  outline  potential  written 
documentation  sources.  Important  at  this  stage,  was  seeking  out  multiple  and  varying 
areas  of  research,  such  as  the  accounting,  legal,  and  military  disciplines.  The  processes 
examined  needed  to  have  subjective  but  defensible  qualitative  methodologies  for 
potential  adaptation  to  the  IAV  methodology.  Documentary  research  was  conducted  of 
contemporary  statutory,  policy,  procedural  and  guidance  material  with  the  focus  for 
uncovering  potential  IAV  model  categories,  factors,  and  patterns. 

Analysis  and  Findings 

The  final  stage  allowed  synthesizing  of  patterns  through  “inductive  reasoning, 
sorting  and  categorizing  [data,  until]  gradually  boiling  it  down  to  a  small  set  of  abstract 
factors”  that  influence  the  quantification  of  value  (Leedy  and  Ormrod  2005:150). 
Utilizing  the  “interpretive  procedures  of  coding  categories  are  used  to  arrive  at  findings,” 
theories,  or  frameworks  for  IAV  (Strauss  and  Corbin  1990:20). 

Chapter  Summary 

The  methodological  strategy,  approach,  application,  of  the  research  were 
discussed  in  this  chapter.  The  research  methodology  accounts  for  the  need  to  quantify 
subjective  human  behavior  through  qualitative  measures  and  the  need  for  an  exploratory, 
investigative  approach  to  uncover  aspects  of  InfoA  valuation.  A  hybrid  methodological 
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strategy  and  approach  have  been  utilized  to  balance  the  positives  and  negatives  of  other 
methodologies.  The  exploratory  IAV  methodology  research  focuses  on  a  qualitative 
hybrid  methodology  for  quantification  of  human  valuation  behavior. 
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IV.  Results  and  Analysis 


Chapter  Overview 

This  chapter  focuses  on  the  analysis  of  the  research  body  to  elicit  an  answer  to  the 
research  question.  Specifically,  this  analysis  looks  at  the  process  for  attributing  value  to 
an  information  asset  and  the  underlying  investigative  questions.  This  chapter  covers  the 
analysis  of  the  potential  IAV  methodology  and  the  contributing  subjective  qualitative 
measures  utilized  in  existing  methodological  approaches  that  may  be  adaptable  to  the 
IAV  methodology,  as  illustrated  in  Figure  7. 
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Figure  7.  Existing  Methodology  Adaptation  Model 
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Analysis  of  Value  Subjectivity 

Value  analysis  requires  the  qualitative  measurement  of  human  behavior  and  is 
therefore  subjective.  The  current  physical  and  quantitative  method  of  valuation  does  not 
take  into  account  information  and  is  therefore  not  capable  of  fully  capturing  the  value  of 
InfoAs.  These  InfoAs  are  growing  throughout  the  cyber  environment  and  their  very 
existence  enables  the  mission  to  be  accomplished.  This  subjectivity  naturally  requires  the 
establishment  of  a  valuation  methodology  that  will  ensure  credibility  in  the  InfoAs.  The 
trust  must  be  seated  in  the  subjective  category  estimations  which  will  build  the  Info  A 
value  construct.  Ultimately,  the  decision  makers  whom  need  this  critical  InfoA  value 
input  must  rely  on  the  underlying  defensible  methodology;  moreover,  this  methodology 
must  be  as  near  a  fact-based  methodology  of  value  estimation  as  may  be  developed. 
Without  a  defensible  methodology,  decision  makers  will  not  have  trust  in  the  valuation 
process  and  would  surely  be  inclined  to  simply  make  their  own  estimations  based  upon 
their  own  beliefs  and  not  the  established,  documented  valuation  estimations. 

Adaptation  of  Other  Methodologies 

An  examination  of  the  three  disciplines,  accounting,  legal,  and  military,  revealed 
methodological  commonalities  of  pre-planning,  documentation,  qualitative  measure 
categories  (QMC),  and  subject  matter  expert  (SME)  to  provide  a  defensible  methodology 
for  adaptation  to  the  IAV  methodology.  Pre-planning  may  be  characterized  as  a 
deliberate  forethought  about  how  the  process  will  provide  for  the  needs  of  the  users  for 
that  process.  Pre-planning  is  also  the  development  of  qualitative  measures  that  will  be 
necessary  in  execution  of  the  process  and  development  of  a  plan  prior  to  a  need  for  the 
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process.  Documentation  is  an  extension  of  the  pre-planning  step  through  personnel 
writing  down  the  plan,  communicating  the  plan  to  others,  and  providing  a  source  and 
resource  for  users  of  the  process  in  decision  making  capacity.  The  qualitative  measure 
definition  is  both  the  qualitative  measure  category  with  associated  definition  and  the 
subjectivity  of  the  category  with  associated  definition.  An  example  of  the  qualitative 
measure  categories  with  definitions  may  be  seen  in  the  CNSI  categories.  CNSI  utilizes 
the  three  levels  of  Top  Secret,  Secret,  and  Confidential  with  associated  definitions  such 
as  “shall  be  applied  to  information,  the  unauthorized  disclosure  of  which  reasonably 
could  be  expected  to  cause  exceptionally  grave,  serious,  or  cause  damage  to  the  national 
security,”  (EO 13292  2003:15315-9).  The  second  part  of  qualitative  measure  definition  is 
the  subjectivity  of  the  measure  and  definition.  The  qualitative  measures  of  the  BCE 
planned  work  order  management  methodology  highlights  subjective  category  definitions 
needing  human  estimation  such  as  “the  planner  determines,”  (AFI32-1001  2005:5).  Also 
found  in  the  CNSI  methodology  are  the  subjective  qualitative  measure  definitions  with 
vague  phrases  which  lend  themselves  to  individual  interpretation,  such  as  “reasonably 
could  be,”  or  “cause  serious  damage,”  (EO  1 3292  2003 : 1 53 1 5-9).  In  the  context  of  the 
reviewed  processes,  the  SME  is  the  individual,  or  group,  that  has  gained  enough 
experience  from  the  pre-planning,  documentation,  and  use  of  the  qualitative  measurement 
categories  as  to  provide  comprehensive  and  competent  estimation  or  judgment.  In 
example  with  the  CNSI,  the  SME  classification  authority  is  expected  to  judge  the 
definition  of  “cause  serious  damage”  based  on  experience  and  knowledge  of  the  subject. 
A  defensible  methodology  is  a  requirement  to  establish  trust  in  the  results  of  the  model 
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and  for  users  of  the  model  to  have  faith  in  the  model.  In  example,  the  EES  process 
represents  the  application  of  subjective  qualitative  measures  on  human  behavior  through 
development  of  comparable  standards  on  personnel  behaviors.  The  defensibility  of  a 
methodology  is  underscored  to  users  of  the  methodology  through  a  culmination  of  pre¬ 
planning,  documentation,  subjective  qualitative  measure  categories,  and  SME. 

Methodology  Commonalities 

An  analysis  of  the  disciplines,  all  of  which  have  developed  over  time, 
demonstrated  similar  characteristics  in  establishing  credibility.  The  credibility  of  the 
methodology  is  exemplified  by  the  discipline  accepting  or  recognizing  the  results  of  the 
discipline  process.  These  characteristics  form  the  adaptation  criteria  that  may  be  utilized 
to  form  a  solid  foundation  of  credibility  in  the  IAV  methodology.  Methodological 
commonalities  derived  from  the  reviewed  discipline  processes,  such  as  pre-planning, 
documentation,  qualitative  measure  categories  (QMC),  subject  matter  expert  (SME)  and 
defensible  methodology  are  illustrated  in  Table  3. 
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Table  3.  Methodology  Commonalities 
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X 

55 


Pre-planning 

Pre-planning  may  be  characterized  as  investing  forethought  into  the  possible 
needs  of  the  process  users,  development  of  what-if  situations  likely  to  be  handled  by  the 
process,  and  documentation  creation  supporting  the  process.  Moreover,  preplanning 
allows  for  the  creation  of  qualitative  measures,  development  of  subject  matter  experts, 
and  most  importantly,  the  realization  that  a  defensible  methodology  has  been  established 
to  provide  faith  in  the  process.  The  pre-planning  allows  for  planners  to  have  a  situational 
awareness  prior  to  any  need  for  the  process,  such  as  with  trouble  tickets  and  work  order 
management,  where  pre-planning  enables  personnel  to  prioritize  the  jobs. 

Pre-planning  is  vital  to  both  the  accounting  and  legal  disciplines  as  much  because 
these  have  developed  over  time  as  to  the  need  for  practical  answers  when  the  situations 
undoubtedly  arise.  Accounting  has  the  advantage  of  history,  but  taken  on  the  whole, 
accounting  demonstrates  a  methodical  approach  to  pre-planning  as  seen  in  each  of  the 
reviewed  disciplines.  The  accounting  history  has  allowed  the  development  of  a  body  of 
pre-planners,  with  organizations  such  as  the  American  Institute  of  Certified  Public 
Accountants  (AICPA),  (AICPA  2007),  Financial  Accounting  Standards  Board  (FASB), 
(FASB141  2001),  and  Governmental  Accounting  Standards  Board  (GASB),  (GASB 
2007).  Similar  to  accounting,  the  legal  discipline  has  the  advantage  of  historic  pre¬ 
planning  refinement  as  seen  in  the  each  of  the  reviewed  areas.  The  law  also  has  the 
advantage  of  many  pre-planning  support  organizations  such  as  the  American  Bar 
Association  (ABA),  (ABA  2007),  American  Bar  Association  Judicial  Division  (ABAJD), 
(ABAJD  2007),  and  Federal  Bar  Association  (FBA),  (FBA  2007). 
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Within  the  military  discipline,  each  example  utilized  in  pre-planning  is  achieved 
by  defining  the  qualitative  categories  with  threshold  measures  prior  to  their  use  by  SME 
in  the  respective  process.  The  principle  of  pre-planning  is  best  captured  by  ORM  as  a 
“deliberate  process  of  thorough  hazard  identification  and  risk  assessment”  requiring 
forethought  and  planning  to  achieve  (AFPAM90-902  2000:12). 

Documentation 

Documentation,  as  a  natural  following  step  or  extension  of  the  pre-planning  step, 
provides  users  of  the  process  with  a  source  and  resource  when  developing  decisions  from 
a  given  process.  Moreover,  documentation  provides  the  ability  to  determine  if  a 
valuation  method  remains  high-quality  over  time  and  allows  institutional  learning  and 
refinement  of  the  assessment  process.  A  benefit  of  documentation  resources  is  the 
establishment  of  accountability  by  personnel,  organizations,  and  entities  within  the 
process.  The  accounting  discipline  has  many  forms  of  documentation  originating  both 
from  government  agencies  and  governing  bodies  such  as  the  IRS  or  FASB.  Additionally, 
the  previously  discussed  accounting  associations  such  as  AICPA  or  GAAP  provide 
guidance  for  the  accounting  discipline.  Similarly,  in  the  legal  discipline,  documents  such 
as  the  UCC  and  USC  provide  governance  but  the  legal  associations,  such  as  ABA  and 
FBA,  provide  governance.  Each  of  the  military  methodologies  evaluated  had  associated 
documentation  guidance  from  the  DoD,  Joint,  or  AF  communities. 

Qualitative  Measure  Categories  (QMC) 

The  qualitative  measure  definition  is  both  the  qualitative  measure  category  with 
associated  definition  and  the  subjectivity  of  the  category  with  associated  definition.  Two 
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examples  of  qualitative  measures  in  the  accounting  discipline  come  from  receivables  for 
bad  debt  and  trademark,  both  of  which  utilize  statistical  calculation  to  establish  value 
over  time.  In  these  two  accounting  instances  the  subjective  measure  definition  is  defined 
by  buyers  and  sellers  whom  may  or  may  not  have  the  knowledge  and  experience  to  create 
effective  estimations.  The  legal  discipline  utilizes  qualitative  categories  that  appear 
quantitative  on  the  surface  but  in  practice  establish  a  subjective  value  within  a  spectrum, 
such  as  with  the  USC  statement,  “not  less  than  $750  or  more  than  $30,000,”  (USC17 
2000).  The  military  exhibits  qualitative  measure  categories  with  definitions  as  seen  in  the 
CNSI  categories  of  Top  Secret,  Secret,  and  Confidential  with  associated  definitions,  such 
as  “shall  be  applied  to  information,  the  unauthorized  disclosure  of  which  reasonably 
could  be  expected  to  cause  exceptionally  grave  [serious,  or  cause]  damage  to  the  national 
security,”  (E013292  2003:15315-9).  Each  methodology  reviewed  contained  qualitative 
measure  categories  with  or  without  documented  definitions. 

The  second  part  of  qualitative  measure  definition  is  the  subjectivity  of  the 
measure  and  definition.  In  accounting,  the  trademark  provides  substantial  subjectivity  in 
the  definition  as  “how  much  the  owner  of  the  trade  name  [would]  pay  to  keep  the  name,” 
(Hitchner  2003:80).  The  subjectivity  in  legal  terms  is  demonstrated  with  trademarks, 
where  the  “judge  at  court  discretion,  enters  a  sum  as  the  court  shall  find  to  be  just,” 
(USC15  2000:1).  The  military  qualitative  measures  of  BCE  planned  work  order 
management  highlights  subjective  category  definitions  needing  human  estimation  such  as 
“reduces  operational  effectiveness”,  “give  adequate  security”,  “breakdown  of  essential 
operating”,  or  “qualifying  for  higher  priority”;  additionally,  the  direct  schedule  work 
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emergency  category  demonstrates  the  subjective  nature  of  the  measurement  with 
“reduces  operational  effectiveness,”  (AFI32-1001  2005:5).  The  HTTM  qualitative 
measures  are  driven  by  the  user  impact  related  to  an  outage  or  degradation  of  the  service 
that  calls  for  estimation  by  the  commander,  work  center,  and  customer.  The  EES  system 
illustrates  qualitative  measurement  categories  with  subjectivity  such  as  “consider 
adapting,”  “consider  dress  and  appearance,”  “above  average,”  or  “clearly  exceeds,” 
(AFForm910  2007;  AFForm911  2007;  AFForm931  2007;  AFForm932  2007).  In  the 
CNSI  methodology,  qualitative  measures  can  easily  be  seen  as  subjective  with  vague 
phrases  such  as  “reasonably  could  be,”  or  “cause  serious  damage”  which  lend  themselves 
to  individual  interpretation  (E013292  2003:15315-9).  The  qualitative  measurement 
categories  definitions  of  ORM  demonstrate  subjectivity  with  phrases  such  as  “major  or 
minor  mission  degradation,”  or  “negligible  loss,”  (AFPAM90-902  2000:17).  HTTM  and 
OPSEC  are  similar  in  that  each  has  qualitative  measure  categories  but  both  rely  on  the 
commander  and  work  center  or  staff  planning  team  (AFI 10-701  2007:12)  to  set  priorities, 
assignments,  and  response  times  (AFI33-1 15V1  2006:48)  of  the  category  definitions. 
Lastly,  UJTL  has  qualitative  measure  categories  with  associated  definitions  and  measures 
of  performance,  such  as  “excess”  and  “capable”  relying  on  the  commander’s 
determination  of  that  performance  (CJCSM3500.04D  2005  :C80). 

Subject  Matter  Expert  (SME) 

In  the  context  of  the  reviewed  processes,  the  Subject  Matter  Expert  (SME)  is  the 
individual,  or  group,  whom  has  gained  enough  experience  from  the  pre-planning, 
documentation,  and  use  of  the  qualitative  measurement  categories  to  provide 
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comprehensive  and  competent  estimation  or  judgment.  Accountants  are  the  SME  where 
“valuation  is  an  art,  not  a  science”  and  this  is  embraced  by  the  FASB.  Relief  from 
royalty  and  investment  value  each  rely  upon  the  knowledge  of  a  SME  to  establish  value, 
such  as  the  SME  5-year  benefit  projection  for  relief  from  royalty  or  the  SME  investor 
estimation  of  open  market  (Hitchner  2003).  In  each  of  these  valuation  instances,  a 
reliance  on  the  experience  and  knowledge  SME  is  used  to  establish  a  legitimate  value. 
The  SME  estimation  of  an  intangible  asset  appears  in  the  R&D  value  “as  an  educated 
guess,”  (Roche  2005).  The  receivable  for  bad  debt  approach  presents  the  most 
quantitative  model  by  refining  a  value  with  statistical  estimation  becoming  more  accurate 
as  time  elapses  (King  2006).  This  same  methodology  could  be  adapted  to  IAV  model 
with  the  SME  estimating  the  initial  value,  and  then  statistically  updating  over  time  to 
increase  the  value  accuracy.  The  idea  of  an  SME  is  not  new  as  in  financial  accounting 
“the  appraiser  makes  the  assumption”  and  “determining  value  for  intangible  assets 
requires  judgment  of  professional,”  (King  2002).  To  further  the  point,  in  financial 
accounting  the  Federal  Accounting  Standards  Board  (FASB)  has  specified  that  appraisers 
should  determine  the  intangible  asset  by  having  the  appraiser  estimate  the  intangible 
asset’s  actual  worth  (King  2002).  Many  SMEs  exist  in  the  legal  discipline  where  it  may 
be  the  judge  or  jury  whom  make  estimations.  The  AF  EES  relies  heavily  upon  the 
supervisor  as  the  SME  to  pass  judgment  on  the  personnel  under  his  or  her  supervision. 
The  commander  or  staff  brings  the  experience  and  skill  to  make  estimations  in  BCE- 
WOM,  HTTM,  OPSEC,  or  UJTL  processes.  In  the  CNSI  model,  the  classification 
authority  as  the  SME  applies  experience  and  judgment  on  information  to  establish 
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information  classification  guidelines.  The  cornerstone  of  ORM  risk  assessment  is  the  use 
of  “estimation”  and  “intuition”  to  establish  a  standard  of  risk  for  hazards,  such  as 
“consider  expert  opinion  and  intuition,”  “my  experienced  NCOs  feel  that  there  is  a  real 
danger  of  the  machine  falling,”  and  “my  gut  feeling  is  that  there  is  a  real  possibility  we 
could  lose  control  of  this  machine  and  topple  it,”  (AFPAM90-902  2000:87,  A83). 

Defensible  Methodology 

A  defensible  methodology  is  a  requirement  to  establish  credibility  in  the  results  of 
the  discipline  process.  The  reviewed  disciplines  of  accounting,  legal  and  military  have 
developed  their  assessment  methodologies  over  time  to  establish  a  defensible 
methodology  as  accepted  by  the  discipline.  As  demonstrated  by  the  reviewed  discipline 
methodologies,  a  defensible  methodology  may  be  viewed  as  the  recognition  or 
acceptance  of  the  processes’  results  by  the  discipline.  Business  buyers  and  sellers  accept 
the  discipline’s  subjective  accounting  method  of  valuation  as  attested  with  the  multitude 
of  transactions  occurring  daily.  Within  the  legal  discipline,  litigation  is  settled  every  day, 
demonstrating  a  measure  of  the  acceptance  by  the  discipline  and  users  of  the  process. 

The  EES  process  best  represents  the  application  of  subjective  qualitative  measures  on 
human  behavior  through  development  of  comparable  standards  for  application  against 
personnel  behaviors;  moreover,  the  supervisor  has  subjective  measures  that  attribute 
confidence  in  the  appropriate  application  of  those  qualitative  measures  on  human 
behavior.  The  military  discipline’s  acceptance  of  the  EES  as  a  subjective,  but  trusted, 
methodology  is  seen  in  the  daily  use  by  Airman  of  all  ranks.  Each  of  the  disciplines 
reviewed  has  developed  their  subjective  valuation  methodologies  over  a  period  of  time 
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and  the  culmination  of  pre-planning,  documentation,  subjective  qualitative  measure 
categories,  and  SME  establishes  within  the  discipline  a  processes’  defensible 
methodology. 

Proposed  Information  Asset  Valuation  (IAV)  Methodology 

This  section  will  cover  the  IAV  methodology  proposal  resulting  from  the  research 
analysis.  The  quantification  of  InfoAs  is  a  multi-step  methodology  including:  the 
information  asset  (InfoA),  developing  factors,  scaling  factors,  aggregating  factor  values, 
aggregating  across  InfoA  values,  and  binding  InfoA  value  to  mission  impact.  The  IAV 
conceptual  model  overview  is  illustrated  in  Figures  8  and  9,  which  demonstrates  the  pre¬ 
cursor,  qualitative  factor,  and  assignment  of  InfoA  value  processes.  The  pre-cursor 
functions  of  InfoA  recognition  and  mapping  are  defined  in  the  CIMIA  program.  As 
illustrated  in  Figure  8,  the  IAV  model  accounts  for  the  recognition  of  an  unknown,  but 
presumably  large,  number  of  InfoAs.  Each  of  the  InfoAs  will  output  the  InfoA  factor 
value  mixture  with  a  single  Tactical  InfoA  value  that  is  comparable  to  other  differing 
InfoAs.  Eikewise,  Figure  9  illustrates  that  many  InfoA  values  will  output  from  the 
Tactical  level  to  the  Operational  level  where  the  IAV  model  is  applied  to  compare 
differing  InfoAs.  As  the  Operational  values  output  to  the  Strategic  level,  again  the  IAV 
model  is  applied  to  compare  the  many  differing  InfoAs.  The  Figure  9  illustration 
indicates  a  single  flow  direction,  however,  if  the  IAV  model  perspectives  discussed  later 
are  introduced  this  graphic  become  bi-directional.  A  pre-defmed  organizational  InfoA 
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value  may  be  applied  at  the  strategic  level  and  flow  back  to  operational  and  then  tactical 
for  a  single  InfoA  value  across  the  domains. 
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Figure  8.  IAV  Model  of  InfoA  Factor  Mixture 


Figure  9.  IAV  Methodology 
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IAV  Model  Qualitative  Factors 

The  quantification  of  an  InfoA  is  a  multi-step  methodology.  The  method  steps 
are:  developing  factors,  scaling  factors,  aggregating  factor  values,  and  aggregating  across 
InfoA  values.  After  the  pre-cursor  steps  of  InfoA  identification  and  mapping,  the  first 
step  of  the  IAV  model  is  determining  the  qualitative  factors  needed  to  quantify  an  InfoA 
value.  Accessibility,  availability,  confidentiality,  contextual,  essentiality,  integrity,  non¬ 
repudiation,  substitution,  and  temporal  all  appear  to  be  factors  for  establishing  the  value 
of  an  InfoA,  specifically  InfoA  1,  as  illustrated  in  Figure  10.  Field  survey  and  testing 
will  be  necessary  to  validate  the  usefulness  of  the  factors  under  realistic  circumstances. 


D 


1)  Mission  Capability:  Law  enforcement  officer  contact  with  CDT1  via  MOT. 
Figure  10.  Example  of  an  Information  Asset,  InfoA  1 
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Accessibility 

The  accessibility  factor  is  characterized  by  the  question,  how  easily  can  I  get  use 
of  this  asset?  In  the  Figure  10  illustration  of  Info  A  1,  the  law  enforcement  officer  may  be 
dispatched  to  an  area  with  intermittent  dead  zone  coverage  resulting  in  the  sporadic  MDT 
accessibility  of  the  network  (link  A). 

Availability 

The  availability  factor  is  characterized  by  the  question,  how  often  can  I  get  use  of 
this  asset?  In  the  Figure  10  illustration  of  InfoA  1,  the  law  enforcement  officer  may 
occasionally  experience  network  saturation  resulting  in  a  sporadic  ability  to  communicate 
with  dispatch  (CDT1). 

Confidentiality 

The  confidentiality  factor  is  characterized  by  the  questions,  would  exposure  be 
detrimental?  In  the  Figure  10  illustration  of  InfoA  1,  the  law  enforcement  officer  may 
have  some  reason  that  the  information  communicated  using  the  MDT  should  be  kept 
secret  from  exposure  to  others. 

Contextual 

The  contextual  factor  is  characterized  by  the  question,  who  and  how  is  the  asset 
used?  The  contextual  nature  of  an  InfoA  is  an  elusive  factor.  In  the  Figure  10  InfoA  1 
illustration,  one  contextual  requirement  for  a  law  enforcement  officer  is  to  communicate 
vitally  important  information  using  the  MDT  such  as  when  conducting  a  traffic  stop  on  a 
murder  suspect  vehicle.  In  this  case  it  is  vital  for  the  officer  to  have  access  to  the  vehicle 
and  criminal  databases  (VDb,  and  SCDb)  for  inquiry  and  determination  that  the  vehicle 
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they  have  stopped  is  considered  armed  and  dangerous.  In  a  low  criticality  context,  the 
law  enforcement  officer  may  notify  dispatch  (CDT1)  of  a  lunch  break.  A  staggering 
number  of  context  situations  may  exist,  and  context  assists  in  prioritization  of  the  InfoA 
value. 

Essentiality 

The  essentiality  factor  is  characterized  by  the  question,  can  I function  without  it? 
In  the  Figure  10  illustration  of  InfoA  1,  the  nature  of  a  law  enforcement  officer’s  duties 
requires  the  ability  to  communicate  with  the  dispatch  (CDT1)  on-demand. 

Integrity 

The  integrity  factor  is  characterized  by  the  question;  can  the  communicated 
information  be  corrupted?  In  the  Figure  10  InfoA  1  illustration,  corrupted  dispatch 
(CDT1)  communication  to  the  MDT  may  prevent  the  law  enforcement  officer  from 
responding  to  an  emergency  or  correct  location. 

Non-repudiation 

The  non-repudiation  factor  is  characterized  by  the  questions,  is  this  really  the 
originator?  In  the  Figure  10  illustration  of  InfoA  1,  dispatch  (CDT1)  needs  to  know  that 
the  information  being  communicated  is  actually  from  an  authorized  law  enforcement 
MDT.  Questionable  communication,  real  or  perceived,  may  prevent  the  appropriate 
response  to  an  emergency. 

Substitutability 

The  substitutability  factor  is  characterized  by  the  questions,  is  there  an  alternative 
source?  In  the  Figure  10  illustration  of  InfoA  1,  the  law  enforcement  officer  may  have  a 
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personal  cell  phone  or  may  be  able  to  locate  a  nearby  house  or  business  with  a  phone  that 
provides  an  alternate  means  to  contact  dispatch  (CDT1). 

Temporal 

The  temporal  factor  is  characterized  by  the  questions,  how  does  the  importance  of 
the  information  change  as  a  function  of  time?  The  temporal  nature  of  the  InfoA  changes 
and  represents  the  most  elusive  of  the  factors.  As  illustrated  by  InfoA  1  of  Figure  10,  the 
requirement  for  a  law  enforcement  officer  to  communicate  with  the  dispatch  (CDT1)  can 
change  from  moment  to  moment.  One  moment,  the  officer  may  be  monitoring  the  flow 
of  traffic  through  a  busy  intersection.  The  next  instant,  the  officer  may  observe  a  major 
accident  and  need  to  immediately  request  fire  and  medical  rescue  units  be  dispatched  to 
the  scene. 

IAV  Model  Factor  Scale 

The  next  step  after  identification  of  the  factors  is  to  apply  quantification  scale  that 
relates  the  factors’  importance  to  the  mission  impact.  One  requirement  of  the  scale  is  that 
it  must  be  easy  to  understand  and  utilize.  Simplicity  of  the  scale  is  necessary  because 
human  interaction,  such  as  manual  input,  will  be  part  of  the  process  with  or  without 
automation.  For  example,  computer  antivirus  software  has  become  increasingly 
automatic  but  for  the  antivirus  software  to  work  effectively  human  interaction  is  still 
required  during  the  configuration  and  input  processes.  The  commonly  utilized  Likert 
scale  may  be  the  most  effective  for  ease  of  use  and  understanding  in  IAV  scaling  levels 
as  illustrated  in  Figure  1 1.  An  effective  Likert  scale  may  have  these  levels:  1  -  Non- 
Critical  Impact,  2  -  Low  Impact,  3  -  Moderate  Impact,  4  -  High  Impact,  5  -  Critical 
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Impact.  Factor  field  testing  will  be  necessary  to  validate  the  most  effective  factor  scaling 
model  as  Critical  Impact  may  not  work  as  effectively  with  the  Accessibility  as  it  does 
with  the  Substitutability  factor. 
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Figure  11.  Example  IAV  Model  Factor  Scale 

IAV  Model  Aggregation 

The  goal  of  IAV  is  to  derive  a  single  comprehensive  value  for  the  InfoA.  Since 
there  is  more  than  one  factor,  the  factors  themselves  need  to  be  aggregated  into  a  single 
InfoA  value.  Additionally,  as  multiple  single  value  InfoAs  filter  from  the  tactical  to  the 
operational  and  finally  the  strategic  domain,  the  InfoA  aggregation  allows  for 
equivalency  comparisons  during  prioritization  efforts  by  decision  makers. 

InfoA  Aggregation  Without  Weight 

The  straight  forward  derivation  may  be  achieved  through  an  averaging  of  factors 
method.  This  basic  averaging  method  establishes  a  situation  where  all  the  factors  are  an 
equal  weighted  value  at  all  times  and  in  all  situations.  The  simple  averaging  method  does 
not  work  in  a  situation  where  the  SME  determines  that  one  or  more  of  the  factor  values 
should  be  ranked  higher  than  all  other  factors  for  a  given  mission.  A  small  example  of  a 
temporal  factor  may  be  seen  in  catching  a  plane  at  the  terminal  where  the  time  a  plane 
departs  is  more  important  than  the  other  factors  because  these  other  factors  are  assumed 
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to  be  previously  satisfied.  From  previous  discussion,  the  potentially  higher  than  average 
significance  of  the  temporal  and  contextual  factors  may  require  a  weighting  method 
which  will  better  reflect  the  organization’s  canonical  InfoA  criticality  value.  In  the  case 
for  an  InfoA,  the  separate  factor  values  calculated  to  a  single  InfoA  value  with  simple 
averaging  methods  is  demonstrated  in  Table  4.  The  simple  averaging  methodology  of  the 
factor  value  mixture  for  InfoA  calculates  to  an  overall  InfoA  value  of  3  for  a  Moderate 
Impact  to  the  mission. 


Table  4.  InfoA  Aggregation  Within  Factor  Values  Without  Weight 


Factor 

Accessibility 

Availability 

Confidentiality 

Contextual 

Essentiality 

Integrity 

Non-Repudiation 

Substitutability 

Temporal 

Total 

InfoA  1 

1 

4 

1 

5 

2 

4 

1 

4 

5 

3 

InfoA  Aggregation  With  Weight 

Similar  to  a  project  management  screening  matrix  (Gray  and  Larson  2003:41)  the 
weighted  calculation  takes  into  account  a  higher  importance  for  the  contextual  and 
temporal  factors  as  illustrated  in  Table  5. 
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Table  5.  InfoA  Aggregation  Within  Factor  Values  With  Weight 


Wei 

Factor 

Accessibility 

Availability 

Confidentiality 

CO 

~>< 

0 
-»— * 

c 

o 

o 

Essentiality 

Integrity 

Non-Repudiation 

Substitutability 

Temporal 

Total 

ght  1 

1 

1 

5 

1 

1 

1 

1 

5 

InfoA  1* 

1 

4 

1 

5 

2 

4 

1 

4 

5 

3 

InfoA  1 

1 

4 

1 

15 

2 

4 

1 

4 

15 

4 

*  Weights  not  included  in  calculation; 
for  visual  comparison 

A  formula  calculation  such  as  illustrated  in  Table  6  (Meredith  and  Mantel 
2006:385),  may  provide  the  necessary  accuracy  of  value  without  overly  complex 
mathematics.  The  essence  of  this  weighted  formula  is  to  add  the  non-weighted  individual 
factor  values  to  the  weighted  individual  factor  values  and  then  divide  by  the  total  number 
of  factor  instances.  This  formula  maintains  the  0-5  scale  while  taking  into  account  the 
higher  weight  of  certain  individual  factors  and  in  this  way  maintains  the  single 
comparable  value  concept  of  the  IAV  model.  In  concept,  Table  5  demonstrates,  forgoing 
the  underlying  mathematics,  the  overall  InfoA  value  with  weights  resulting  in  a  4  -  High 
Impact  to  the  mission  instead  of  a  less  accurate  3  -  Significant  Impact.  In  the  scope  of 
this  scenario,  and  in  the  broader  context  of  real  application,  the  weighted  value  may  more 
accurately  represent  the  mission  impact  for  the  users  of  this  IAV  model. 
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Table  6.  InfoA  Aggregation  Weighted  Formula  (Meredith  and  Mantel  2006:385) 


V  =  InfoA  Value 

V  f+FW 

T 

/=  Factor  Sum 

F  =  Weighted  Factor  Sum 

W =  Weight 

T  =  Total  Factor  Instances 

Aggregation  Across  InfoA  Values 

The  goal  of  IAV  is  to  provide  the  ability  to  establish  the  value,  as  a  single 
expression,  for  an  InfoA  for  comparison.  InfoAs  will  exist  in  the  tactical,  operational, 
and  strategic  domains.  Tactical  being  the  lowest  level  will  establish  an  initial  InfoA 
value  from  either  an  organization  or  individual  perspective.  Each  of  these  levels  will 
have  multiple  InfoAs  to  value,  compare,  and  prioritize.  After  the  tactical  level  prioritizes 
the  differing  InfoAs,  the  values  will  pass  up  to  the  operational  level.  The  operational 
level,  like  the  tactical,  will  have  multiple  InfoAs  to  value,  compare,  and  prioritize  before 
passing  the  values  up  to  the  strategic  level.  Finally,  the  strategic  level  will  also  have 
multiple  InfoAs  to  value,  compare,  and  prioritize.  At  each  level  a  factor  valuation  will 
aggregate  to  derive  a  single  InfoA  value  that  is  passed  up  to  the  next  level.  The  end 
result  is  that  a  low  level  InfoA  will  bubble  up  to  the  strategic  level  for  decision  making. 
Table  7  illustrates  a  tactical,  operational,  or  strategic  level  InfoA  prioritized  listing  with 
InfoA  1  having  the  lowest  value  of  1  -  Non-Critical  Impact,  and  InfoA  5,  or  InfoA  6  with 
weights,  having  the  highest  value  of  5  -  Critical  Impact. 
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Table  7.  Aggregation  Across  Multiple  Info  As 


Factor 

Accessibility 

Availability 

Confidentiality 

05 

-»— * 

X 

CD 
-*— » 

C 

o 

O 

Essentiality 

Integrity 

Non-Repudiation 

Substitutability 

Temporal 

Total 

1 

1 

1 

5 

1 

1 

1 

1 

5 

InfoA  1* 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

InfoA  2* 

1 

1 

1 

1 

3 

4 

1 

1 

5 

2 

InfoA  3* 

1 

1 

2 

2 

2 

4 

5 

5 

5 

3 

InfoA  4* 

3 

3 

4 

4 

4 

4 

4 

5 

5 

4 

InfoA  5* 

5 

5 

5 

5 

5 

5 

5 

5 

5 

5 

InfoA  6* 

2 

4 

1 

5 

2 

4 

3 

4 

5 

4 

InfoA  6 

2 

4 

1 

25 

2 

4 

3 

4 

25 

5 

*  Weights  not  included  in  calculation; 
for  visual  comparison 

The  example  of  Table  7  will  immediately  identify  for  planners  and  decision 
makers  the  need  to  manage,  protect,  or  exploit  InfoA  5  in  execution  of  the  mission. 
Assuming  that  weights  have  been  utilized  in  the  initial  InfoA  valuation,  a  weight  system 
may  not  be  necessary  at  the  level  where  aggregation  across  multiple  InfoA  takes  place. 
However,  an  important  key  to  this  methodology  is  providing  an  adjustment  mechanism 
along  the  hierarchal  path.  From  the  tactical  to  strategic  level,  personnel  will  need  to 
modify  what  they  judge  to  be  an  inaccurate  value  because  personnel  may  not  have 
enough  knowledge  about  a  specific  InfoA  for  accurate  judgments,  personnel  may  not 
have  enough  time  to  comprehensively  deal  with  the  InfoA  value,  or  personnel  may  need 
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to  simply  rectify  a  system  anomaly.  The  action  taken  could  be  a  simple  plus  up  or  down 
of  the  factor  values  or  the  overall  value. 

IAV  Model  Binding  to  CIMIA 

Binding  the  IAV  model  to  the  CIMIA  program  equates  to  linking  the  InfoA  value 
to  the  mission  impact  alerts  and  linking  the  temporal  aspects  of  mission  executing.  The 
preceding  steps  of  the  IAV  model  have  established  a  value  for  the  InfoA  in  an  abstract. 
The  “mission  binding  construct  reflects  the  criticality  of  the  InfoA  to  the  organization’s 
mission,”  (Fortson  2007:192)  through  a  user  friendly  visual  and  effect  on  the  mission  of  a 
period  of  time.  This  final  step  of  the  IAV  model  binds  for  IAV  model  presentation  and 
time-cycles  to  the  CIMIA  program. 

Binding  Presentation 

The  importance  of  InfoA  value  becomes  more  apparent  for  planners  and  decision 
makers  with  the  incorporation  of  other  attributes  in  a  visual  presentation.  In  example,  the 
InfoA  value  of  5  -  Critical  Impact  takes  on  more  meaning  when  the  InfoA  is  bound  to 
other  attributes  such  as  the  problem  of  “circuit  7JA  is  down,”  the  mission  description  of 
“ATO  generation  capability  for  theater- wide  refueling,”  the  InfoA  status  of  “technicians 
are  troubleshooting,”  and  that  an  alternative  “dial-up  circuit  9D72  at  degraded  speed” 
exists.  Specifying  the  problem,  mission  description,  status,  alternatives,  and  a  visual 
display  as  illustrated  in  Figure  12,  represents  a  rudimentary  culmination  of  these 
additional  attributes  supporting  the  InfoA  value  represented  by  the  alert  banner. 
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Figure  12.  Conceptual  CIMIA  Visual 


In  step  with  the  CIMIA  goal  to  provide  a  DSS  that  is  naturally  intuitive  for 
personnel  to  understand  and  utilize,  the  Department  of  Homeland  Security  (DHS) 
development  of  the  Homeland  Security  Advisory  System  (HSAS)  (DHS  2008)  has 
presentation  characteristics  similar  to  the  CIMIA  presentation  requirements.  From 
frequent  public  exposure,  the  HSAS  should  have  a  broad  range  of  familiarity  to  the 
personnel  utilizing  the  CIMIA  DSS  tool  which  will  ease  utilization  and  foster  acceptance. 
Borrowing  from  the  HSAS  scheme  as  an  overlay  for  Figure  1 1,  a  new  IAV  model  factor 
scale  presentation  binding  is  created  as  illustrated  in  Figure  13. 
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Figure  13.  IAV  Example  Value  Scale  with  Criticality 


Binding  Time  Cycles 

The  main  CIMIA  presentation  window  will  provide  a  concise  level  of  information 
for  planners  and  decision  makers,  however  lower  drill-down  levels  will  be  necessary  to 
add  more  detail  information.  One  level  of  drill-down  will  be  the  graphic  time  cycle 
relationship  of  an  InfoA  to  mission  criticality  over  a  specified  time  period  for  mission 
planning  projections.  Figures  14,  15,  and  16  illustrate  the  InfoA-to-mission-impact  of  a 
30-day  cycle,  or  an  average  month. 

The  first  criticality  example,  Figure  14,  is  straight  forward  with  a  low  InfoA 
value,  or  criticality.  The  criticality  is  low  and  flat,  rapidly  increases  during  an  eight  day 
peak,  and  then  returns  to  low  and  flat  criticality.  This  InfoA  is,  from  a  decision  maker’s 
perspective,  is  valuable  for  only  a  short  period  of  the  month,  but  has  significant  temporal 
importance  when  the  InfoA  is  being  utilized. 
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Figure  14.  IAV  Example  Criticality  Cycle  1 


The  second  criticality  example,  Figure  15,  demonstrates  a  gradual  growth  in  the 
InfoA  criticality  until  a  single  day  peak  and  then  a  gradual  return  to  a  low  criticality. 
From  a  decision  maker  perspective,  this  InfoA  is  valuable  for  the  entire  month  cycle. 
This  situation  would  indicate  to  decision  makers  that  constant  vigilance  in  protecting  the 
resource  may  be  necessary  over  the  time  cycle. 
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Days  in  a  Month 


Figure  15.  IAV  Example  Criticality  Cycle  2 

The  third  criticality  example,  Figure  16,  is  actually  a  criticality  error.  The 
criticality  error  illustrated  if  Figure  16  is  the  mirror  opposite  of  Figure  14  and 
demonstrates  the  importance  of  this  InfoA.  During  the  tactical,  operational,  or  strategic 
planning  phase  of  a  mission,  the  critical  error  graphic  identifies  periods  when  the  InfoA  is 
vulnerable.  This  critical  error  graphic  would  indicate  to  planners  the  vital  nature  of  this 
InfoA  to  the  mission  impact  at  hand,  over  the  time  cycle,  and  failure  of  the  InfoA  during 
the  time  cycle  may  potentially  cause  failure  of  the  mission. 
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Figure  16.  IAV  Example  Criticality  Error  Cycle 


IAV  Model  Comprehensive  Example 

The  core  benefit  of  the  IAV  model  is  the  association  of  mission  capability  to  the 
InfoA,  which  strengthens  the  importance  of  the  InfoA  to  the  organization.  In  this  section 
a  comprehensive  example  will  be  utilized  to  demonstrate  concepts  of  the  IAV  model. 
Refer  to  Figure  17,  as  well  as  following  the  discussion,  for  detail  on  the  example  scenario 
utilized  throughout  this  section  to  demonstrate  key  IAV  model  concepts. 

The  following  comprehensive  IAV  model  scenario  example  utilizes  the  following 
entities:  1)  a  law  enforcement  agency  as  the  organizational  owner  of  the  entire  system  of 
systems,  2)  a  law  enforcement  agency  system  of  systems,  3)  a  law  enforcement  officer 
(LEO),  and  4)  various  day  to  day  missions  being  conducted  by  the  LEO. 
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The  law  enforcement  agency  system  of  system,  as  illustrated  in  Figure  17,  is 
composed  of  the:  1)  Mobile  Datalink  Terminal  (MDT),  the  lowest  level  interface  system 
for  accessing  the  wider  system  of  systems  through  the  Central  Dispatch  Terminal  and  the 
primary  means  for  the  LEO  to  interface  with  the  law  enforcement  agency  system  of 
systems;  2)  Central  Dispatch  Terminal  (CDT),  or  CDT1,  a  city,  municipality,  or  county 
level  system  that  is  able  to  interface  with  other  systems  within  the  law  enforcement 
agency’s  system  of  systems  and  the  primary  interface  system  for  the  MDT;  3)  State 
Dispatch  Terminal  (SDT),  the  next  higher  level  system  above  the  CDT  that  is  able  to 
interface  with  other  systems  within  the  law  enforcement  agency’s  system  of  systems;  4) 
Vehicle  Database  (VDb),  the  state  database  with  vehicle  and  vehicle  owner  information; 
5)  State  Criminal  Database  (SCDb),  the  database  with  criminal  personal  information;  6) 
Central  Dispatch  Terminal  Two  (CDT2),  the  CDT  in  the  adjacent  city,  municipality,  or 
county  to  CDT1,  7)  Air  Support  Datalink  Terminal  (ASDT),  the  air  support  link  to  the 
law  enforcement  agency’s  system  of  systems,  and  8)  Links  A-H,  the  various  wired  and 
wireless  network  connections  within  the  law  enforcement  agency’s  system  of  systems. 

The  day  to  day  missions  of  the  LEO  must  be  accomplished  through  the  law 
enforcement  agency’s  system  of  systems  and  these  mission  capabilities,  as  illustrated  in 
Table  8,  are:  1)  contact  with  the  CDT,  2)  vehicle  license  plate  inquiry,  3)  criminal 
inquiry,  4)  request  for  air  surveillance  support,  and  5)  directing  air  surveillance  support. 
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1)  Mobile  DatalinkTcrminal(MDT)  6)  Central  Dispatch  Terminal  2  {CDT2} 

2)  Central  Dispatch  Terminal  (CDT)  7)  A,  B,  C,  D,  E,  F,  G  &  H: 

3)  State  Dispatch  Terminal  (SDT)  ConnectingTransmissionLinks 

4)  Vehicle  Database  (VDb) 

5)  State  Criminal  Database (SCDb) 


Figure  17.  Example  Scenario  Detail 


Table  8.  Examp 

e  Scenario  Detail  Mission  Capability 

Mission  Capability  1 

Contact  with  CDT  via  MDT 

Mission  Capability  2 

Vehicle  license  plate  inquiry 

Mission  Capability  3 

Criminal  inquiry 

Mission  Capability  4 

Request  for  air  surveillance  support 

Mission  Capability  5 

Directing  air  surveillance  support 
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Simple  InfoA  Scenario  Example 


Utilizing  a  simple  point-to-point  InfoA,  as  illustrated  in  Figure  18,  the  three 
components  of  InfoA  1  (MDT,  CDT1,  and  transmission  link  A)  comprise  the  entire 
InfoA  1  and  enable  the  mission  capability  1  to  be  accomplished.  Figure  18,  utilized  in 
the  following  IAV  model  concept  explanations,  is  provide  for  reader  convenience,  but  is 
identical  to  previously  utilized  Figure  10.  The  LEO  has  a  mission  requirement  to  contact 
CDT1  via  the  MDT  and  this  could  be  for  an  unremarkable  reason  such  as  a  break  or  a 
more  important  reason  such  as  a  traffic  stop;  moreover,  the  overall  InfoA  1  value,  as 
illustrated  in  Table  7,  is  1  for  a  Low  Impact.  Failure  or  degradation  of  the  MDT,  CDT1, 
or  link  A  will  prevent  the  law  enforcement  officer  from  successfully  communicating  with 
CDT1  as  expressed  in  mission  capability  1. 


1)  Mission  Capability:  Law  enforcement  officer  contact  with  CDT1  via  MDT, 


Figure  18.  Example  of  an  Information  Asset,  InfoA  1 
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IA  V  Model  Perspectives 

The  IAV  model  is  frame  of  reference  dependent.  In  our  example,  the  law 
enforcement  officer  has  one  perspective  of  value,  but  the  mobile  data  terminal  used  by  a 
combat  soldier  may  have  a  very  different  perspective  and  value.  Another  example  is  that 
the  law  enforcement  officer  may  have  a  value  and  the  law  enforcement  officer’s 
organization  may  have  another  value  for  the  same  InfoA.  These  two  examples 
demonstrate  the  separate  prospective  of  organization  and  individual.  In  example,  using 
CDT1  as  the  organizational  representative  of  the  law  enforcement  agency,  CDTl’s 
organizational  value  of  InfoA  1,  as  illustrated  in  Figure  18,  may  be  established  as  5  for 
Critical  Mission  Impact  and  applied  to  all  like  InfoAs  regardless  of  the  situation. 
Moreover,  the  LEO  as  the  individual,  where  there  is  a  lack  of  an  organizationally 
mandated  InfoA  value,  may  establish  InfoA  1,  as  illustrated  in  Figure  18,  as  3  for  a 
Significant  Mission  Impact.  An  organizational  perspective  is  a  policy-based  mixture  of 
factor  values  to  arrive  at  a  single  InfoA  value.  An  organizational  policy  would  most 
likely  be  developed  from  a  team  of  personnel  knowledge  about  the  InfoA  with 
management  concurrence.  The  organization  as  a  whole  may  have  a  defined  perspective 
with  the  InfoA  having  a  standard  factor  value  mix  with  a  standard  overall  value.  Table  7 
demonstrates  for  InfoA  1  an  example  standard  factor  mix  and  value  that  an  organization 
may  place  on  all  such  similar  InfoAs  utilized  within  that  organization.  The  policy  may 
apply  to  a  specific  InfoA,  or  group  of  similar  InfoAs,  but  ultimately  provides  guidance  to 
all  personnel  interacting  with  the  InfoA.  The  organizational  perspective  is  a  prime  driver 
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for  the  CIMIA  project,  but  as  the  IAV  methodology  matures,  the  individual  value  will 
become  more  practical  and  necessary. 

Complex  InfoA  Scenario  Example  1 

Figure  19  illustrates  a  more  complex  example  of  an  InfoA.  The  four  components 
of  InfoA  2  (MDT,  CDT1,  SDT,  VDb,  and  transmission  links  A,  B,  C)  enable  the  mission 
capability  2  to  be  accomplished.  The  LEO  has  made  a  traffic  stop  and  has  a  requirement 
to  determine  who  owns  the  vehicle;  moreover,  the  overall  InfoA  value,  as  illustrated  in 
Table  7,  is  2  for  a  Moderate  Impact.  Should  a  system,  server,  or  link  be  in  degraded  or 
failure  status,  the  LEO  will  be  unable  to  conduct  a  license  plate  inquiry  as  expressed  in 
mission  capability  2. 


Figure  19.  Example  of  an  Information  Asset,  InfoA  2 
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Complex  InfoA  Scenario  Example  2 

Figure  20  illustrates  an  increasingly  higher  level  example  of  a  complex  InfoA. 

The  five  components  of  InfoA  3  (MDT,  CDT1,  SDT,  VDb,  SCDb  and  transmission  links 
A,  B,  C,  D)  enable  the  mission  capability  3  to  be  accomplished.  During  the  traffic  stop 
the  LOE  has  determined  the  vehicle  owner  and  has  a  requirement  to  determine  if  the 
owner  is  a  criminal;  moreover,  the  overall  InfoA  value,  as  illustrated  in  Table  8,  is  3  for  a 
Significant  Impact.  Should  a  system,  server,  or  link  be  in  degraded  or  failure  status  then, 
the  LEO  will  be  unable  to  conduct  a  license  plate  inquiry  and  subsequent  criminal  inquiry 
as  expressed  in  mission  capability  3. 


3)  Mission  Capability:  Law  enforcement  officer  criminal  inquiry. 


Figure  20.  Example  of  an  Information  Asset,  InfoA  3 
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Static  vs.  Dynamic  InfoAs 

It  is  important  in  the  comprehensive  example  scenario  to  discuss  the,  at  least  two 
possible  and  distinct  states  of  InfoAs:  static  and  dynamic.  InfoAs  are  composed  of  the 
connecting  components  from  among  the  system  of  systems  and  this  system  of  system  is 
part  of  the  real  changing  world  in  which  it  resides.  Therefore  the  system  of  system 
changes  frequently  and  without  warning,  however  there  are  situations  where  the  system 
remains  fixed  for  a  period  of  time,  such  as  a  month,  year,  or  decade.  These  periods  of 
time  when  the  system  of  system  experiences  little  change  over  time  will  be  referred  to  as 
static.  The  static  state  is  much  more  easily  dealt  with  when  the  existence  of  the  Info  A  is 
constant.  The  static  state  of  an  InfoA  is  characterized  by  infrequent  change,  and  when 
change  does  occur  the  change  is  telegraphed  through  the  system  in  a  way  that  the  system 
of  system  is  able  to  adapt  to  the  change.  In  example,  InfoA  3  (MDT,  CDT1,  SDT,  VDb, 
SCDb  and  transmission  links  A,  B,  C,  D),  as  illustrated  in  Figure  20,  is  likely  to  stay  in  a 
constant  component  configuration  and  InfoA  3  is  less  likely  to  change  significantly  or 
frequently.  The  stability  of  these  InfoA  components  enables  a  static,  steady  state  to 
emerge  that  fosters  InfoA  identification,  mapping,  and  valuation.  The  dynamic  nature  of 
an  InfoA  emerges  in  InfoA  4,  as  illustrated  in  Figure  12,  components  (MDT,  CDT1, 
CDT2,  ASDT,  and  links  A,  E,  F,  G,  H),  that  change  significantly  and  with  great 
frequency.  The  frequent  change  of  components  will  necessitate  more  effort  to  track  and 
understand  the  changes.  As  previously  discussed,  this  dynamic  nature  highlights  the 
elusiveness  of  the  temporal  and  contextual  InfoA  factors. 
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Complex  InfoA  Scenario  Example  3 

This  next  comprehensive  scenario  example  demonstrates  the  dynamic 
requirement  to  satisfy  the  mission  capability  4,  the  LEO  needs  to  request  air  surveillance 
support.  The  LEO  requires  air  surveillance  support  because  the  traffic  stop  vehicle  owner 
is  a  criminal  and  has  fled  the  scene  on  foot.  The  LEO  would  normally  make  the  air 
surveillance  support  request  via  CDT1  from  within  the  InfoA  4  (MDT,  CDT1,  CDT2, 
ASDT,  and  links  A,  E,  F,  G,  H),  as  illustrated  in  Figure  21;  moreover,  the  overall  InfoA 
value,  as  illustrated  in  Table  8,  is  4  for  a  High  Impact.  A  degradation  or  failure  of 
transmission  link  A  from  within  InfoA  4  necessitates  the  LEO  to  utilize  CDT2  as  a 
substitute.  This  substitution  necessitates  a  change  from  InfoA  4  to  InfoA  5. 


Figure  21.  Example  of  an  Information  Asset,  InfoA  4 
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Figure  22  illustrates  a  simple  InfoA  where  substitutability  may  modify  value.  The 
failure  of  InfoA  4  allows  InfoA  5  to  act  as  a  substitute  and  the  LEO  to  continue  with  the 
mission  capability  task.  From  an  organizational  perspective,  this  substitution  temporarily 
decreases  the  value  of  InfoA  4  from  4  -  High  Impact  to  a  lower  level  of  3  -  Significant 
Impact,  because  the  organization  decision  makers  recognize  the  substitute  is  available. 
Likewise,  the  InfoA  4  value  is  decreases  because  the  LEO  recognizes  that  the  substitute 
is  available  to  accomplish  the  mission  capability  task,  from  an  individual  perspective. 

The  LEO  is  able  to  execute  the  mission  capability  4  with  InfoA  5  (MDT,  CDT2,  ASDT, 
and  links  G,  F),  which  has  a  value  of  5  -  Critical  Impact.  Should  the  InfoA  5  system  or 
link  be  in  degraded  or  failure  status,  the  LEO  will  be  unable  to  conduct  a  request  for  air 
surveillance  support  in  accomplishing  mission  capability  4. 


4)  Mission  Capability:  Law  enforcement  officer  request  for  air  surveillance  support. 
Figure  22.  Example  of  an  Information  Asset,  InfoA  5 

Figure  23  illustrates  a  simple  InfoA  where  the  dynamic  nature  of  realism 

intervenes  to  add  weight  on  contextual  and  temporal  factors.  At  this  point  in  the  example 
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scenario  the  LEO  has  a  requirement  to  communicate  and  direct  the  actions  of  air 
surveillance  to  capture  a  fleeing  criminal.  This  dynamically  changes  the  original  value  of 
InfoA  6  (MDT,  ASDT,  and  link  H),  as  illustrated  in  Table  8,  of  4  for  a  High  Impact,  both 
contextually  and  temporally,  in  the  accomplishment  of  mission  capability  5.  The  new 
requirement  for  the  LEO  to  coordinate  with  air  surveillance  support  to  capture  the  fleeing 
criminal  changes  the  value  of  InfoA  6  to,  as  illustrated  in  Table  8,  5  for  a  Critical  Impact. 


5)  Mission  Capability:  Law  enforcement  officer  directing  air  surveillance  support. 

Figure  23.  Example  of  an  Information  Asset,  InfoA  6 

Binding  an  InfoA  to  the  CIMIA  program  visual  presentation  can  be  understood 
with  InfoA  6.  In  the  final  portion  of  the  comprehensive  example,  InfoA  6  has  a  value  of 
5-  Critical  Impact;  moreover,  should  a  component  be  in  degraded  or  failure  status,  then 
the  LEO  will  be  unable  to  coordinate  air  surveillance  support  to  capture  the  fleeing 
criminal  as  expressed  in  mission  capability  5.  If  InfoA  6  becomes  degraded  or  in  failure 
status  the  CIMIA  visual  presentation  tool  will  notify  CDT2  with  red  5  Severe  —  Critical 
Impact  alert  banner,  similar  to  the  illustration  in  Figure  12. 
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An  example  of  binding  an  InfoA  to  the  time  cycle  may  be  understood  from  the 
InfoA  6  scenario.  The  time  cycle  for  InfoA  6  is  measured  in  hourly  increments,  such  as 
with  a  24  hour  clock,  and  represents  one  area  along  the  temporal  spectrum  from  seconds 
to  multi-year.  Figure  24  illustrates  that  over  a  24-hour  time  cycle,  InfoA  6  is  at  a  peak 
value  of  5-  Critical  Impact  for  only  a  short  period  of  two  hours.  This  two-hour  window 
represents  the  part  of  the  scenario  where  the  LEO  is  coordinating  air  surveillance  efforts 
to  capture  the  fleeing  criminal;  however,  the  other  periods  of  time  are  a  steady  lower 
value  of  1  -  Low  Impact  representing  the  non-use  of  the  ASDT. 
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Figure  24.  Time-Cycle  Binding  Example  1  for  InfoA  6 


A  modification  of  the  mission  capability  task  for,  InfoA  6  allows  an  illustration  of 
the  time  binding  and  criticality  error.  Applying  a  new  mission  capability  to  InfoA  6,  such 
as  the  LEO  requesting  air  support  for  escorting  dignitaries  through  the  city,  allows  an 
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exhibit  of  time  cycle  binding  and  criticality  error.  Figure  25  illustrates,  over  a  24-hour 
cycle,  the  LEO  preparation  slowly  increases  the  value  of  InfoA  6  until  a  peak  period 
when  the  LEO  is  escorting  the  dignitaries  through  the  city  and  then  the  gradual  decline  of 
InfoA  6  value  as  the  LEO  conduct  post  activities.  This  new  view  of  time  cycle  binding 
demonstrates  how  the  IAV  model  may  translate  to  the  realistic  and  dynamic  environment 
of  the  real  world.  During  the  planning  stages  of  the  new  InfoA  6  scenario  allows 
planners  to  visualize  the  potential  periods  when  the  InfoA  must  be  maintained,  bolstered, 
or  prevented  from  failing.  Figure  26  is  a  mirror  opposite  of  Figure  24  and  illustrates  that 
should  InfoA  6  be  in  a  degraded  or  failure  status  during  the  lowest  point  then  the  mission 
capability  may  fail. 


Hours  in  a  Day 


Figure  25.  Time-Cycle  Binding  Example  2  for  InfoA  6 
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Figure  26.  Criticality  Error  Example  for  InfoA  6 


IA  V Model  Comprehensive  Example  Summary 

The  comprehensive  example  has  demonstrated  the  key  IAV  model  concepts  of 
aggregating  qualitative  factors  to  a  single  InfoA  value,  aggregation  across  multiple 
InfoAs,  individual  and  organization  perspectives,  InfoAs  that  are  static  and  dynamic,  and 
binding  InfoAs  to  the  CIMIA  program. 

Chapter  Summary 

This  chapter  has  sought  to  uncover  the  subjective  nature  of  qualitative  measures 
for  human  behavior  quantification  and  develop  commonalities  among  various  public  and 
government  sector  methodologies  for  adaptation  to  the  IAV  model.  An  examination  of 
existing  subjective  methodologies  identified  commonalities  that  demonstrate  the 
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trustworthiness  and  defensibility  the  discipline  processes  within  the  respective  discipline 
and  these  commonalities  translate  to  proposed  IAV  methodology  as  a  real  possibility. 
The  IAV  model  quantification  of  InfoAs  is  a  multi-step  process  including:  developing 
factors,  scaling  factors,  aggregating  factor  values,  aggregating  across  InfoA  values,  and 
binding  InfoA  value  to  mission  impact  alerts.  The  IAV  model  factors  of  accessibility, 
availability,  confidentiality,  contextual,  essentiality,  integrity,  non-repudiation, 
substitution,  and  temporal  with  the  application  of  a  criticality  scale  may  be  able  define  a 
single  standardized  value  InfoAs;  resulting  in  the  ability  to  compare  differing  InfoAs 
from  separate  organization  and  units.  The  further  aggregation  of  separate  InfoA  value 
through  the  tactical,  operational,  and  strategic  domains  provide  critical  cyber-battlespace 
awareness  to  decision  makers. 
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V.  Conclusions  and  Proposals 


Chapter  Overview 

This  chapter  discusses  the  conclusions  of  the  IAV  methodology  through  the 
proposed  CIMIA  solutions,  proposed  IAV  methodology,  and  proposed  IAV 
implementation,  and  then  addresses  research  limitations  with  future  research  areas. 

Proposed  CIMIA  Solutions 

The  impetus  for  the  IAV  methodology  is  founded  in  the  goals  outlined  by  the 
CIMIA  program,  such  as  linking  infrastructure  to  mission,  near  real-time  incident 
notification,  incident  trend  analysis,  and  predictive  incident  effect  forecasting  (Thiem 
2005;  Fortson  2007).  Fortson  brought  CIMIA  forward  extensively  with  the  development 
of  the  five  phase  mission  impact  assessment  model.  The  independent,  but  collaborative, 
CIMIA  model  functions  are:  1)  Information  Asset  Identification  (IAI)  is  the  realization 
that  an  information  asset  exists  and  needs  to  be  documented;  2)  Information  Asset-to- 
Mission  Mapping  (IAMM)  is  the  process  of  documenting  the  internal  and  external 
connections  of  the  information  asset;  3)  Information  Asset  Valuation  (IAV)  is  the  process 
of  establishing  a  standardized  and  comparable  information  asset  criticality  value;  4) 
Damage  Assessment  (DA)  is  the  presentation  of  cyber  battlespace  awareness  with  near 
real-time  information  asset  status  for  decision  makers  to  act  upon,  and  5)  Damage-to- 
Mission  Assessment/Impact  Reporting  (DMAIR),  is  the  information  asset  historical 
archive  for  trend  analysis  and  what-if  scenario  forecasting  (Fortson  2007).  A  CIMIA 
program  decision  support  tool  may  be  able  to  bond  the  infrastructure-to-mission  and  the 
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separate  functions  of  communications-to-operations  through  single  visual  presentation  for 
decision  makers. 

The  IAV  methodology  is  the  CIMIA  function  that  connects  the  other  functions. 
The  IAV  methodology  enables  decision  makers  to  determine  if  an  identified  InfoA  merits 
further  resources  to  maintain,  monitor,  and  protect.  The  IAV  methodology  allows 
scoping  InfoA  mission  mapping  activity  through  determining  the  minimum  and 
maximum  number  of  connections;  additionally,  without  the  IAV  methodology,  mission 
mapping  may  result  in  analysis  paralysis  as  all  the  connection  possibilities  are  thoroughly 
researched.  The  core  task  for  CIMIA  is  the  DA  providing  effective  assessment 
information  to  decision  makers  and  the  IAV  methodology  with  a  single  InfoA  value  at 
the  heart  of  providing  this  actionable  visual  information  to  decision  makers.  The  IAV 
methodology,  again  with  a  single  InfoA  value  that  enables  comparison  across  the 
spectrum  of  different  InfoAs,  enables  trend  analysis  and  future  mission  impact 
forecasting.  Trend  analysis  benefits  from  the  ability  of  reviewing  InfoAs  over  time  to 
determine  where  costs  could  be  saved  through  reduction  or  elimination  of  InfoAs; 
additionally,  trend  analysis  benefits  from  identifying  those  InfoAs  that  merit  more 
investment  to  assist  in  mission  success.  One  of  the  potentially  more  powerful  IAV 
methodology  functions  will  be  a  what-if  forecasting  capability  which  allows  planners  to 
visually  identify  those  InfoAs  with  the  greatest  impact  to  mission  success.  The  what-if 
capability  may  be  utilized  to  add  or  remove  InfoAs  from  a  given  plan  to  determine  the 
mission  impact  prior  to  actual  implementation.  The  ultimate  goal  for  the  IAV 
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methodology  is  to  provide  foundational  research  solutions  which  may  be  implemented  in 
the  CIMIA  program  through  a  decision  support  tool  utilized  by  decision  makers. 

Proposed  IAV  Methodology 

The  proposed  IAV  methodology  covers  the  subjectivity  of  human  behavior 
valuation,  contributions  of  other  disciplines,  framework,  and  single  InfoA  value. 

Value  is  a  human  behavior  with  quantitative  measurement  challenges  but  the  IAV 
methodology  proposes  qualitative  measurement  with  the  understood  subjectivity  issues. 
Complete  valuation  of  an  InfoA  including  the  intrinsic  and  intangible  aspects  pose  major 
problems  for  current  physical-based  valuation  methods.  The  significant  growth  of  InfoAs 
throughout  the  cyber  environment  enables  mission  accomplishment  but  the  physical 
methods  need  to  catch  up  to  the  growth.  The  IAV  methodology  credibility  rests  with  the 
naturally  subjective  qualitative  measures  and  how  these  are  validated.  The  reviewed 
discipline  processes  demonstrate  a  defensible  methodology  to  be  a  methodology  where 
practices  have  been  validated  and  accepted  by  the  discipline  utilizing  the  methodology. 
Decision  makers  whom  need  this  critical  InfoA  value  from  the  DA  function  must  be  able 
to  rely  upon  the  underlying  methodology;  moreover,  this  methodology  must  be  as  near  a 
fact-based  methodology  of  value  estimation  as  may  be  developed.  Without  a  defensible 
methodology,  decision  makers  will  not  have  trust  in  the  valuation  process.  The  result 
may  be  for  decision  makers  to  rely  on  personal  estimations  based  on  their  own  beliefs 
and  not  the  established  documented  valuation  estimations. 

The  IAV  methodology  proposes  that  the  term  information  asset ,  or  InfoA,  is  the 
convergence  of  information  tangibles,  information  intangibles,  and  information  flow  to 
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materialize  as  a  functional  entity  that  enhances  the  mission  capability  through  physical 
and  intrinsic  contribution.  A  common  definition  is  the  starting  point  for  compatible 
interaction  among  the  users  of  CIMIA  and  specifically  users  of  the  IAV  methodology  in 
reference  to  InfoA  discussion. 

Contributing  Disciplines 

The  foundation  of  initial  investigation  into  the  IAV  methodology  is  discovery 
research  where  analysis  of  other  disciplines  may  provide  answers;  and,  this  research 
examined  the  three  disciplines  of  accounting,  legal,  and  military.  The  contribution  of 
these  long  standing  disciplines  and  processes  revealed  methodological  commonalities  of 
pre-planning,  documentation,  qualitative  measure  categories  (QMC),  and  subject  matter 
expert  (SME).  It  is  from  these  adaptation  criteria  that  each  discipline  recognizes  their 
processes  as  subjective,  yet  trusted,  and  result  in  a  defensible  methodology.  A  discipline 
accepting  the  results  of  a  process  methodology,  as  demonstrated  by  the  reviewed 
disciplines,  establishes  the  defensibility  of  the  methodology. 

Utilizing  these  same  adaptation  criteria,  the  IAV  methodology  research  provides 
pre-planning,  documentation,  and  QMC.  The  IAV  methodology  research  has  examined 
InfoA  valuation,  which  is  just  one  form  of  forethought  about  the  valuation  topic  area; 
certainly,  future  research  will  continue  to  contribute  to  the  area  of  pre-planning.  The 
development  of  this  research  is  the  beginning  of  the  documentation  process.  This  IAV 
methodology  research  has  identified  nine  potential  QMC  valuation  factors  that  are 
utilized  to  calculate  an  overall  InfoA  value.  IAV  methodology  research  has  identified  the 
SME  as  those  individuals  with  the  experience  and  knowledge  whom  are  currently 
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bridging  the  infrastructure -to-mission  gap  and  bonding  the  separate  functional  areas  of 
communications-to-operations.  It  is  from  these  long  standing  discipline  processes 
making  use  of  the  adaptation  criteria  that  will  enable  the  IAV  methodology  to  be 
subjective,  but  credible,  methodology. 

Framework 

The  IAV  framework  builds  from  the  pre-cursor,  or  sequential,  activities  of  InfoA 
identification  and  mission  mapping  to  development  of  a  single  InfoA  value.  The  SME 
applies  and  aggregates  InfoA  factors  to  arrive  at  a  single  value.  The  IAV  framework 
factors  for  InfoA  value  are:  1)  Accessibility,  cannot  logically  get  to  the  InfoA;  2) 
Availability,  can  access  but  cannot  use  the  InfoA;  3)  Confidentiality,  information 
communicated  should  be  kept  from  exposure  traversing  the  InfoA;  4)  Contextual,  specific 
situation  or  circumstances  compel  importance  of  the  InfoA;  5)  Essentiality,  indispensable 
facilitator  for  executing  the  mission  with  the  InfoA;  6)  Integrity,  information 
communicated  is  free  from  flaws  though  traversing  the  InfoA;  7)  Non-repudiation, 
information  communicated  is  actually  from  originator  though  traversing  the  InfoA;  8) 
Substitutability,  existence  of  an  alternate  InfoA;  and  9)  Temporal,  the  effect  time  has  on 
the  effectiveness  of  the  InfoA  to  execute  the  mission.  The  commonly  utilized  Likert 
scale  is  utilized  by  the  SME  to  measure  the  level  of  importance  each  factor  contributes  to 
the  overall  value,  and  the  scale  levels  are:  1  -  Non-Critical  Impact,  2  -  Low  Impact,  3  - 
Moderate  Impact,  4  -  High  Impact,  5  -  Critical  Impact.  The  InfoA  factor  value  mixture 
is  the  factors  with  applied  scale,  utilizing  an  averaging  calculation  establishes  the  single 
InfoA. 
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The  factor  scale  serves  three  purposes:  1)  it  is  the  scale  for  measuring  each 
individual  factor,  2),  it  is  the  scale  for  measuring  the  overall  InfoA  value  calculated,  and 
3)  it  is  the  scale  that  matches  up  to  the  CIMIA  criticality  alerts.  The  single  InfoA  value  is 
immediately  recognizable  by  decision  makers  as  the  criticality  of  the  InfoA  to  the 
mission  impact.  Having  this  one  scale  serve  all  three  purposes  bind  the  IAV  model  to  the 
CIMIA  model. 

The  three  domains  of  tactical,  operational,  and  strategic  utilize  the  IAV 
framework  to  establish  InfoA  value  for  prioritization  efforts.  At  the  initial  tactical  level, 
the  SME  attributes  each  factor  with  a  value  from  the  scale  which  calculates  to  a  single 
InfoA  value.  The  tactical  level  may  have  more  than  one  InfoA.  Once  each  InfoA  has  an 
established  value,  a  prioritization  is  required  to  determine  which  InfoA,  or  InfoAs,  are 
most  vital  to  mission  accomplishment.  The  single  InfoA  value  enable  the  tactical  level  to 
compare  these  differing  InfoA  based  on  the  same  measurement  standards  for  prioritizing 
the  most  important  InfoA.  The  operational  level  receives  InfoA  values  from  the  number 
of  tactical  level  entities  and  must  also  prioritize  these  many  InfoA  values.  The  IAV 
framework  enables  the  operational  level  to  utilize  the  same  prioritization  procedure  as  the 
tactical.  Likewise,  as  the  many  InfoA  values  input  to  the  strategic  level,  the  IAV 
framework  enables  prioritizing.  It  is  the  single,  comparable  InfoA  values  of  the  IAV 
methodology  which  enables  the  tactical,  operational,  and  strategic  domains  to  prioritize 
the  multitude  of  InfoAs. 
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Single  Comparable  InfoA  Value 

The  IAV  methodology  establishes  a  single  InfoA  value  which  serves  the  purpose 
of  comparison  and  decision  maker  ease  of  use.  Establishing  a  single  InfoA  value  enables 
decision  makers  to  compare  the  many  differing  InfoAs.  In  example,  InfoA  1  may  be  an 
aircraft  intelligence  system  and  InfoA  2  may  be  a  computer  database  system,  but  the  use 
of  similar  IAV  framework  measurement  criteria  allows  these  two  different  InfoAs  to  be 
compared  based  on  value  to  the  mission.  Decision  makers  would  benefit  from  having  a 
single,  recognizable,  reference  value  for  each  InfoA.  This  single  recognizable  reference 
value  for  each  InfoA  should  enable  decision  makers  to  quickly  and  easily  understand  the 
importance  of  relationship  of  this  InfoA  to  the  mission. 

Proposed  IAV  Implementation 

The  IAV  methodology  would  benefit,  as  well  as  provide  benefit,  through 
implementation  in  well  defined  work  centers  at  the  tactical  and  operational  levels.  Some 
examples  of  well  defined  work  centers  are:  Combined  Air  Operations  Center,  Joint  Air 
Operations  Center  (JAOC),  Air  Operations  Center  (AOC),  Battle  Staff,  and  Command 
Post  (CP).  The  smaller  work  centers  have  the  best  chance  of  maintaining  a  nimble  and 
effective  IAV  methodology  growth  in  supporting  decision  makers,  planners,  and  the 
overall  mission. 

Limitations/Future  Research 

The  most  appropriate  method  for  transferring  the  limitations  and  future  research 
of  this  thesis  is  through  expansion  of  the  CIMIA  tool  functionalities  (IAI,  IAMM,  IAV, 
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DA,  and  DMAIR)  through  the  eyes  of  a  planner.  A  planner  may  be  either  deliberate  as  a 
strategic  and  operational  planner  with  an  operational  mission  plan  or  proactive/reactive  as 
a  tactical  planner  with  an  immediate  surveillance  air  tasking  order. 

The  first  CIMIA  phase  is  information  asset  identification,  or  the  LAI,  and  is  the 
comprehension  that  an  InfoA  actually  exists  (Fortson  2007).  There  is  an  IAV 
methodology  research  limitation  in  that  it  is  difficult  to  match  the  IAV  methodology  to 
IAI  without  a  working  or  absolute  understanding  of  LAI.  An  area  of  research  that  should 
be  undertaken  to  understand,  and  scope,  is  the  complexity  of  IAI  in  reference  to  manual 
human  requirements  and  computer  automation  of  this  function.  Ultimately,  identification 
of  an  InfoA  is  a  human  decision.  In  a  manual  process  the  human  planner  will  identify  an 
InfoA  through  manual  inputs  to  CIMIA.  Through  the  automation  of  IAMM 
functionality,  discussed  next,  where  the  InfoA  is  automatically  presented  to  the  planner, 
the  human  planner  will  still  need  to  confirm  the  validity  of  that  InfoA.  Various  reasons 
exist  for  a  planner  to  reject  a  pre-identified  InfoA  with  one  reason  being  an  InfoA  that 
falls  out  of  individual  or  organizational  perspective  of  mission  necessity. 

The  second  CIMIA  phase  is  information  asset  mission  mapping,  or  the  IAMM, 
and  is  the  process  of  documenting  the  internal  and  external  connections,  or  linkages,  of 
the  identified  InfoA  (Fortson  2007).  From  this  researcher’s  perspective,  IAMM  is  one  of 
the  more  difficult  parts  of  CIMIA  that  needs  to  be  researched  and  scoped.  Many  network 
mapping  software  tools  exist  to  map  networks,  servers,  and  data,  and  presumably  IAMM 
will  be  automated  to  present  human  planners  with  potential  InfoAs  identified  in  the  IAI 
functionality  of  CIMIA.  In  addition  to  the  human  planner  input  to  guide  the  mapping 
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process,  hopefully,  human  planners  will  be  able  to  force  the  mapping  as  necessary  where 
the  automation  is  not  capable  of  connecting  the  linkage.  Similar  to  LAI,  there  is  an  IAV 
methodology  research  limitation  in  that  it  is  difficult  to  match  the  IAV  methodology  to 
IAMM  without  a  working  or  absolute  understanding  of  IAMM. 

The  third  CIMIA  phase,  IAV,  is  perhaps,  the  function  which  connects  the  other 
phases  together.  This  research  into  IAV  methodology  seeks  to  establish  a  valuation 
methodology  for  InfoAs  that  planners  may  trust  and  have  faith  in  during  the  decision 
making  process.  The  IAV  methodology  puts  the  IAI  and  IAMM  functions  to  work  while 
providing  vital  Info  A  status  to  the  DA  and  DM  AIR  functions. 

This  thesis  paper’s  proposed  IAV  methodology  solution,  or  some  variant,  will 
require  a  Joint  solution  that  is  capable  of  serving  beyond  the  DoD  to  a  more  broad 
government  service  on  the  whole  for  national  security.  Future  IAV  methodology 
research  into  other  Services  (Army,  Navy,  Marine,  and  Coast  Guard),  government 
agencies  (IRS,  NSA,  etc.),  and  public  sector  would  be  a  significant  contribution  to  the 
InfoA  valuation  research. 

A  limitation  of  the  IAV  research,  and  an  area  for  future  research,  is  the  ability  to 
locate  and  survey  the  personnel  who  currently  bridge  the  communications  and  operations 
disconnect.  A  survey  would  be  a  vital  tool  for  validating  the  utility  of  the  IAV 
methodology  and  the  IAV  framework  valuation  factors  and  factor  scale.  Based  on  this 
initial  research  an  example  survey  was  constructed,  see  Appendix  B  (Rehg  2007). 
Locations  such  as  Air  Operations  Centers  (AOC),  Combined  Air  Operation  Centers 
(CAOC),  Joint  Air  Operations  Centers  (JAOC)  and  the  newly  introduced  Cyber 
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Command  may  be  readily  fdled  with  these  knowledgeable  personnel.  Once  located, 
these  knowledgeable  personnel  will  be  instrumental  in  validating  the  IAV  model  factors 
as  well  as  developing  refined  factor  consensus  through  a  Delphi  study.  The  planners  will 
have  the  cross-community  knowledge,  communications-to-operations,  making  them 
capable  of  deciding  the  InfoA  factor  value  mixture  when  establishing  an  overall 
organizational  InfoA  value.  As  this  research  has  exposed  the  scope  and  limitations  of 
IAV  methodology,  further  research  will  be  necessary  to  move  the  IAV  methodology 
forward. 

The  fourth  CIMIA  phase  is  damage  assessment,  or  the  DA,  and  is  the  presentation 
of  cyber  battlespace  awareness  with  near  real-time  InfoA  status  (Fortson  2007).  The  core 
of  this  function  is  the  presentation  of  the  InfoA  status  to  the  planner  and  needs  to  take 
into  account  the  differing  possible  perspectives;  moreover,  the  goal  should  be  to  provide 
the  best  possible  presentation  that  works  with  the  thought  processes  of  the  planner.  In  the 
end,  the  IAV  model  must  integrate  with  the  planner’s  working  and  thought  processes  to 
achieve  maximum  decision  making  effect  with  minimum  time  loss. 

The  last  CIMIA  phase  is  the  damage-to-mission  assessment  and  impact  reporting, 
or  the  DMAIR,  and  is  the  historical  archive  for  trend  analysis  and  what-if  scenario 
forecasting  (Fortson  2007).  Where  the  DA  was  looking  at  the  present,  DMAIR  is  really 
two  separate  functions  looking  at  the  past  and  future.  As  CIMIA  performs,  over  time, 
historical  data  will  develop  that  will  enable  a  trend  analysis  of  the  InfoA  values  and  the 
resulting  impact  on  the  mission.  A  future  area  of  IAV  methodology  research  is  how  to 
store  the  current  InfoA  value  such  that  timeless  retrieval  and  relevant  display  are 
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possible.  The  what-if  scenario  development  functionality,  through  the  manipulation  of 
InfoA  in  a  degraded,  failure,  or  battle  eliminated  context,  will  enable  planners  to  shape 
the  mission  effectiveness  over  a  given  period  of  time  prior  to  execution  of  the  plan.  The 
IAV  methodology  would  improve  with  further  research  into  the  effect  of  time  on  the 
dynamic  nature  of  the  IAV  methodology. 

Chapter  Summary 

This  chapter  discusses  the  conclusions  of  the  IAV  methodology  through  the 
proposed  CIMIA  solutions,  proposed  IAV  methodology,  and  proposed  IAV 
implementation,  and  then  addresses  research  limitations  with  future  research  areas.  The 
IAV  methodology  research  attempts  to  assist  the  AF  and  DoD  with  an  automated  DSS 
tool  to  provide  a  better  understanding  of  the  relationship  between  communications 
infrastructure  and  operations  mission  impact.  This  research  has  been  conducted  under 
the  mentorship,  and  benefit  of,  the  Air  Force  Research  Laboratory  (AFRL)  CIMIA 
program.  The  IAV  methodology  seeks  to  define  the  term  information  asset  (InfoA)  as 
the  convergence  of  information  tangibles,  information  intangibles,  and  information  flow 
to  materialize  as  a  functional  entity  that  enhances  the  mission  capability.  The  IAV  model 
research  attempts  to  quantify  the  InfoA  through  attributing  factors  with  assigned  weights 
for  calculation  of  an  overall  value.  IAV  research  examines  existing  non-military  and 
military  valuation  methodologies  for  adaptability  to  the  IAV  model.  The  intention  of  this 
work  is  the  development  of  foundational  methodologies  supporting  the  creation  of  an 
automated  CIMIA  DSS  tool  to  provide  near  real  time  cyber  environmental  awareness  for 
effective  decision  making  prior  to,  during,  and  post  cyber  incident  situations. 
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Appendix  A:  Intangible  Assets  Classes  (FASB141  2001:28) 


1)  Marketing-related  intangible  assets 

a)  Trademarks,  trade  names 

b)  Service  marks,  collective  marks,  certification  marks 

c)  Trade  dress  (unique  color,  shape,  or  package  design) 

d)  Newspaper  mastheads 

e)  Internet  domain  names 

f)  Non-competition  agreements 

2)  Customer-related  intangible  assets 

a)  Customer  lists 

b)  Order  or  production  backlog 

c)  Customer  contracts  and  related  customer  relationships 

d)  Non-contractual  customer  relationships 

3)  Artistic-related  intangible  assets 

a)  Plays,  operas,  ballets 

b)  Books,  magazines,  newspapers,  other  literary  works 

c)  Musical  works  such  as  compositions,  song  lyrics,  advertising  jingles 

4)  Pictures,  photographs 

a)  Video  and  audiovisual  material,  including  motion  pictures,  music  videos, 
television  programs 

5)  Contract-based  intangible  assets 

a)  Licensing,  royalty,  standstill  agreements 

b)  Advertising,  construction,  management,  service  or  supply  contracts 

c)  Lease  agreements 

d)  Construction  permits 

e)  Franchise  agreements 

6)  Operating  and  broadcast  rights 

a)  Use  rights  such  as  drilling,  water,  air,  mineral,  timber  cutting,  and  route 
authorities 

b)  Servicing  contracts  such  as  mortgage  servicing  contracts 

c)  Employment  contracts 

7)  Technology-based  intangible  assets 

a)  Patented  technology 

b)  Computer  software  and  mask  works 

c)  Unpatented  technology 

d)  Databases,  including  title  plants 

e)  Trade  secrets,  such  as  secret  formulas,  processes,  recipes 
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Appendix  B:  IAV  Example  Survey  (Rehg  2007) 


I.  Create  your  code. 


Understanding  the  sensitivity  of  maintaining  your  privacy,  and  anonymity,  a  disposable  code  will 
be  generated  as  a  marker  for  this  survey.  The  code  will  be  used  to  link  this  survey  to  your 
previous  or  future  surveys  in  this  study. 

Your  name  and/or  demographic  information  are  NOT  required  on  the  survey  for  any  purpose. 
Please  do  not  provide  such  information. 


Your  code  consists  of  the  first  2  letters  of  your  mother  and  father’s  first  names,  and  the  numerical 
month  and  day  of  your  birthday.  An  example  is  below: _ 


Exam] 

pie: 

Mother’s  first  name:  Jane 

F ather  ’  s  first  name :  John 

Birth  month  and  day:  January  1st  (01/01) 

Your  Code  would  be:  jajoOlOl 

After  developing  your  unique  code,  write  it  in  the  boxes  below,  and  continue  to  the  next  page. 


First  two  letters  of 

Mother’s  first  name 

First  two  letters  of 

Father’s  first  name 

Your  Birth  Month  and  Day 

(do  not  include  the  year) 

PRIVACY  NOTICE 


In  accordance  with  AFI  37-132,  Paragraph  3.2,  the  following  information  is  provided  as  required  by  the  1974  Privacy  Act 

Authority:  10  U.S.C.  8012,  Secretary  of  the  Air  Force;  powers  and  duties;  delegation  by;  implemented  by  AFI  36-2601, 
Air  Force  Personnel  Survey  Program. 

Purpose:  To  obtain  information  regarding  the  attitudes  and  knowledge  of  personnel  enrolled  in  the  fundamentals  of 
acquisition  management  course,  and  evaluate  the  effectiveness  of  acquisition  program  manager  education  and  training. 
Routine  Use:  A  final  report  will  be  provided  to  AFIT/LS.  No  analysis  of  individual  responses  will  be  conducted  and  only 
members  of  the  research  team  will  be  permitted  access  to  the  raw  data.  Reports  summarizing  trends  in  large  groups  of 
people  may  be  published. 

Participation:  Participation  is  VOLUNTARY.  No  adverse  action  will  be  taken  against  any  member  who  does  not 
participate  in  this  survey  or  who  does  not  complete  any  part  of  the  survey. 
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II.  Overall  Information  Asset  Valuation  (IAV)  methodology.  Using  the  scale  below, 
indicate  the  extent  that  you  agree  with  the  following  statements.  Use  the  blank  space  at  the 
beginning  of  each  statement  to  record  the  number  of  your  choice. _ 

1  2  3  4  5 

Strongly  Disagree  Neutral  Agree  Strongly 

Disagree _ Agree 

_ 1 .  I  am  able  to  understand  the  concept  and  practical  application  of  the  IAV  model. 

_ 2.  I  understand  the  definition  of  an  information  asset. 

_ 3.  I  believe  the  IAV  model  will  be  helpful  in  the  execution  of  my  duties. 

_ 4.  I  believe  the  IAV  model  is  unusable  in  the  execution  of  my  duties. 

_ 5.  My  performance  may  be  improved  with  the  IAV  model  or  similar  device. 

_ 6.  My  duties  require  me  to  determine  the  mission  impact  of  cyber  incidents. 

_ 7.  I  am  part  of  a  team  that  determines  the  mission  impact  of  cyber  incidents. 

_ 8.  I  have  no  need  of  knowing  mission  impact  resulting  from  cyber  incidents. 

_ 9.  I  (my  team)  frequently  scramble  to  determine  the  impact  of  cyber  incidents. 

_ 10.  I  (my  team)  frequently  make  estimation  in  determining  the  impact  of  cyber  incidents. 


II.  This  portion  of  the  survey  contains  questions  related  to  the  qualitative  information  asset 
factors  of  the  Information  Asset  Valuation  (IAV)  methodology.  Using  the  scale  below, 
indicate  the  extent  that  you  agree  with  the  following  statements.  Use  the  blank  space  at  the 
beginning  of  each  statement  to  record  the  number  of  your  choice. 


1  2 
Never  Seldom 


3 

Occasionally 


4 

Frequently 


5 

Almost  Always 


_ 11.  I  would  use  the  factor  “Accessibility”  as  characterized  by  the  question,  “how  easily  can  I 

get  use  of  this  asset?” 

_ 12.  I  would  use  the  factor  “Availability”  as  characterized  by  the  questions,  “how  often  can  I 

get  use  of  this  asset?” 

_ 13.  I  would  use  the  factor  “Confidentiality”  as  characterized  by  the  question,  “would 

exposure  be  detrimental?” 

_ 14.  I  would  use  the  factor  “Contextual”  as  characterized  by  the  questions,  “who  and  how  the 
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asset  is  used?” 


_ 15.  I  would  use  the  factor  “Essentiality”  as  characterized  by  the  questions,  “can  I  function 

without  it?” 

_ 16.  I  would  use  the  factor  “Integrity”  as  characterized  by  the  question,  “can  the 

communicated  information  be  corrupted?” 

_ 17.  I  would  use  the  factor  “Non-repudiation”  as  characterized  by  the  questions,  “is  this  really 

the  originator?” 

_ 18.  I  would  use  the  factor  “Substitutability”  characterized  by  the  questions,  “is  there  an 

alternative  source?” 

_ 19.  I  would  use  the  factor  “Temporal”  as  characterized  by  the  questions,  “how  does  the 

importance  of  the  information  change  as  a  function  of  time?” 


III.  Information  Asset  Valuation  (IAV)  methodology  factor  scale.  Using  the  scale  below, 
indicate  the  extent  that  you  agree  with  the  following  statements.  Use  the  blank  space  at  the 
beginning  of  each  statement  to  record  the  number  of  your  choice. _ 

1  2  3  4  5  6  7 

Strongly  Disagree  Slightly  Neutral  Slightly  Agree  Agree  Strongly 

Disagree _ Disagree _ Agree 

_ 20.  It  is  easy  to  understand  how  the  factor  scale  is  utilized. 

_ 21.  The  factor  scale  is  appropriate  and  flexible  enough  for  my  duties. 

_ 22.  My  duties  require  a  scale  with  more  levels  for  greater  specificity. 

_ 23.  The  factor  scale  as  an  alert  system  of  mission  criticality  will  be  easy  to  use. 

_ 24.  It  is  difficult  to  distinguish  among  the  levels. 

_ 25.  My  duties  require  a  simpler  factor  scale. 
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Part  IV.  Work  Experiences.  Please  look  at  the  following  duty  titles/areas  and  rate 
those  that  apply  to  your  current  position.  If  a  duty  title/area  does  not  apply,  there  is  no 

need  to  assign  a  number  to  it. _ 

1  2  3  4  5  6 

Almost  Never  Once  in  a  while  Occasionally  Usually  Quite  Often  Almost  Always 


Since  arriving  at  your  job,  to  what  degree  have  you  been  involved  with  or  worked  with... 
I.  AOC.  CAOC.  JAOC. 

Deal  with  cyber  incidents _ 

Analyze  cyber  incidents _ 

Assign  mission  impact  of  incidents _ 

Work  cyber  incidents  for  Operations _ 

Work  cyber  incidents  for  Communications _ 

Work  cyber  incidents  for  other _ 


II.  Battle  Staff,  Command  Post.  Similar 

Deal  with  cyber  incidents 
Analyze  cyber  incidents 
Assign  mission  impact  of  incidents 
Work  cyber  incidents  for  Operations 
Work  cyber  incidents  for  Communications 
Work  cyber  incidents  for  other 


58.  Please  write  any  comments  below  that  you  would  like  to  provide  about  your  AFFAM  class 
and  /  or  your  work  experiences  (use  additional  paper  if  necessary): 


Thank  you  for  taking  the  time  to  complete  the  survey!  Please  put  your  survey  into  the  pre¬ 
addressed  return  envelope  and  put  it  in  official  mail,  or  place  it  in  a  separate  envelope  and  mail  to: 

CIMIA  Project 
AFIT/ENV 
2950  Hobson  Way 
Wright-Patterson  AFB,  OH  45433 
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Appendix  C:  Glossary 


ABA  -  American  Bar  Association 

ABAJD  -  American  Bar  Association  Judicial  Division 

AOC  -  Air  Operations  Center 

AF  -  Air  Force 

AFRL  -  Air  Force  Research  Laboratory 

AFForm  -  Air  Force  form 

AFI  -  Air  Force  Instruction 

AFMAN  -  Air  Force  Manual 

AFMCL  -  Air  Force  Master  Capabilities  List 

AFNOSC  -  Air  Force  Network  Operations  and  Security  Center 

AFP  AM  -  Air  Force  Pamphlet 

ARC  -  Archival  Research  Catalog 

ASDT  -  Air  Support  Data  Terminal 

AUTL  -  Army  Universal  Task  List 

BCE  -  Base  Civil  Engineering 

BCE-WOM  -  Base  Civil  Engineering  Work  Order  Management 
CAOC  -  Combined  Air  Operations  Center 

CAPM  -  Capital  Asset  Pricing  Model  or  alternate  Capital  Asset  Pricing  Model 
CCIR  -  Commander’s  Critical  Information  Requirement 

CERCLA  -  Comprehensive  Environmental  Response  Compensation  and  Liability  Act  of 
1980 

CDT  -  Central  Dispatch  Terminal 

CIL  -  Critical  Information  Listing 

CIP  -  Critical  Information  Program 

CJCS  -  Chairman  Joint  Chiefs  of  Staff 

CJCSM  -  Chairman  Joint  Chiefs  of  Staff  Manual 

CNSI  -  Classified  National  Security  Information 

DA  -  Damage  Assessment 

DHS  -  Department  of  Homeland  Security 

DMAIR  -  Damage -to-Mission  assessment/impact  Reporting 

DoD  -  Department  of  Defense 

DoDD  -  Department  of  Defense  Directive 

DSS  -  Decision  Support  Software 

EES  -  Enlisted  Evaluation  System 

EO  -  Executive  Order 

EPR  -  Enlisted  Performance  Reporting 

EPS  -  Engineering  Performance  Standards 

FBA  -  Federal  Bar  Association 

FASB  -  Financial  Accounting  Standards  Board 

FMY  -  Fair  Market  Value 

FV  -  Fair  Value 

GAAP  -  Generally  Accepted  Accounting  Principles 
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GASB  -  Government  Accounting  Standards  Board 

HSAS  -  Homeland  Security  Advisory  System 

HTTM  -  Helpdesk  Trouble  Ticket  Management 

IGBV  -  International  Glossary  of  Business  Valuation 

InfoA  -  Information  Asset 

IAI  -  Information  Asset  Identification 

IAMM  -  Information  Asset  Mission  Mapping 

IAV  -  Information  Asset  Valuation 

IP  -  Intellectual  Property 

IRS  -  Internal  Revenue  Service 

IT  -  Internet  Technology 

JAOC  -  Joint  Air  Operations  Center 

JCS  -  Joint  Chiefs  of  Staff 

JFC  -  Joint  Force  Commander 

LEO  -  Law  Enforcement  Officer 

MAJCOM  -  Major  Command  (United  States  Air  Force) 

MDT  -  Mobile  Datalink  Terminal 

NARA  -  National  Archives  and  Records  Administration 

NCC  -  Network  Control  Center 

NOSC  -  Network  Operations  and  Security  Center 

NSA  -  National  Security  Agency 

OPSEC  -Operational  Security 

ORM  -  Operational  Risk  Management 

OWG  -  Operations  Working  Group 

PFW  -  Performance  Feedback  Worksheet 

PME  -  Professional  Military  Education 

PMO  -  Program  Management  Office 

QMC  -  Qualitative  Measurement  Categories 

R&D  -  Research  and  Development 

R&DV  -  Research  and  Development  Value 

SCDb  -  State  Criminal  Database 

SCL  -  Sales  Contact  Listing 

SDT  -  State  Dispatch  Terminal 

SME  -  Subject  Matter  Expert 

TR  -  Treasury  Regulation 

UCC  -  Uniform  Commercial  Code 

UJTL  -  Universal  Joint  Task  List 

UNTL  -  Universal  Naval  Task  List 

USC  -  United  States  Code 

U.S.C.  -  United  States  Code 

USPTO  -  United  States  Patent  and  Trademark  Office 

VDb  -  Vehicle  Database 

WACC  -  Weighted  Average  Cost  of  Capital 
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